Edit tour

Windows Analysis Report
HkObDPju6Z.exe

Overview

General Information

Sample Name:	HkObDPju6Z.exe
Analysis ID:	886219
MD5:	6441d7260944bcedc5958c5c8a05d16d
SHA1:	46257982840493eca90e051ff1749e7040895584
SHA256:	723d1cf3d74fb3ce95a77ed9dff257a78c8af8e67a82963230dd073781074224
Infos:

Detection

BlackBasta

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected BlackBasta ransomware

Found ransom note / readme

Found Tor onion address

Machine Learning detection for sample

Contains functionality to modify clipboard data

May disable shadow drive data (uses vssadmin)

Writes a notice file (html or txt) to demand a ransom

Deletes shadow drive data (may be related to ransomware)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Abnormal high CPU Usage

AV process strings found (often used to terminate AV products)

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Extensive use of GetProcAddress (often used to hide API calls)

Tries to load missing DLLs

Contains functionality to read the PEB

Found large amount of non-executed APIs

Uses Microsoft's Enhanced Cryptographic Provider

Creates a process in suspended mode (likely to inject code)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64native

HkObDPju6Z.exe (PID: 332 cmdline: C:\Users\user\Desktop\HkObDPju6Z.exe MD5: 6441D7260944BCEDC5958C5C8A05D16D)

cmd.exe (PID: 312 cmdline: C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

vssadmin.exe (PID: 8948 cmdline: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet MD5: B58073DB8892B67A672906C9358020EC)

cmd.exe (PID: 3944 cmdline: cmd.exe /c start /MAX notepad.exe c:\instructions_read_me.txt MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

notepad.exe (PID: 1352 cmdline: notepad.exe c:\instructions_read_me.txt MD5: E92D3A824A0578A50D2DD81B5060145F)

HkObDPju6Z.exe (PID: 1508 cmdline: "C:\Users\user\Desktop\HkObDPju6Z.exe" MD5: 6441D7260944BCEDC5958C5C8A05D16D)

cmd.exe (PID: 3292 cmdline: C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

vssadmin.exe (PID: 4644 cmdline: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet MD5: B58073DB8892B67A672906C9358020EC)

HkObDPju6Z.exe (PID: 5560 cmdline: "C:\Users\user\Desktop\HkObDPju6Z.exe" MD5: 6441D7260944BCEDC5958C5C8A05D16D)

cmd.exe (PID: 1808 cmdline: C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

vssadmin.exe (PID: 8264 cmdline: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet MD5: B58073DB8892B67A672906C9358020EC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Black Basta	"Black Basta" is a new ransomware strain discovered during April 2022 - looks in dev since at least early February 2022 - and due to their ability to quickly amass new victims and the style of their negotiations, this is likely not a new operation but rather a rebrand of a previous top-tier ransomware gang that brought along their affiliates.	No Attribution	https://assets.sentinelone.com/sentinellabs22/sentinellabs-blackbasta https://gbhackers.com/black-basta-ransomware/ https://mandiant.widen.net/s/pkffwrbjlz/m-trends-2023 https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf https://quadrantsec.com/resource/technical-analysis/black-basta-malware-overview	https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbasta

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000A.00000003.22756871962.00000000028F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
0000001E.00000002.27586886931.0000000003343000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
00000003.00000003.22575159083.0000000002F20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
0000000E.00000003.22839485707.0000000002980000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
0000000E.00000002.22856927512.0000000002A90000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
Process Memory Space: HkObDPju6Z.exe PID: 332	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
Process Memory Space: HkObDPju6Z.exe PID: 1508	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
Process Memory Space: HkObDPju6Z.exe PID: 5560	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
Process Memory Space: notepad.exe PID: 1352	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
10.3.HkObDPju6Z.exe.28f0000.0.raw.unpack	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
14.3.HkObDPju6Z.exe.2980000.0.unpack	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
14.2.HkObDPju6Z.exe.2a90000.1.raw.unpack	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
10.2.HkObDPju6Z.exe.2a40000.1.raw.unpack	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
3.3.HkObDPju6Z.exe.2f20000.0.raw.unpack	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
14.2.HkObDPju6Z.exe.2a90000.1.unpack	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
10.2.HkObDPju6Z.exe.2a40000.1.unpack	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
14.3.HkObDPju6Z.exe.2980000.0.raw.unpack	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
10.3.HkObDPju6Z.exe.28f0000.0.unpack	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
3.3.HkObDPju6Z.exe.2f20000.0.unpack	JoeSecurity_BlackBasta	Yara detected BlackBasta ransomware	Joe Security
Click to see the 5 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: HkObDPju6Z.exe	ReversingLabs: Detection: 59%
Source: HkObDPju6Z.exe	Virustotal: Detection: 69%			Perma Link

Machine Learning detection for sample

Source: HkObDPju6Z.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02A7ECB0 CryptAcquireContextA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,CryptAcquireContextA,	10_2_02A7ECB0
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02A7F280 CryptReleaseContext,	10_2_02A7F280
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02A7F390 CryptGenRandom,CryptReleaseContext,	10_2_02A7F390
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02AEA750 CryptReleaseContext,	10_2_02AEA750

Source: HkObDPju6Z.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Google\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Internet Explorer\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office 15\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Update Health Tools\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\MSBuild\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Realtek\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Reference Assemblies\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Uninstall Information\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\UNP\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Defender\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Mail\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Media Player\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Multimedia Platform\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows NT\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Photo Viewer\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Portable Devices\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Security\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\WindowsPowerShell\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\DESIGNER\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\Services\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\System\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Google\Chrome\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Internet Explorer\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Internet Explorer\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Internet Explorer\images\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Internet Explorer\SIGNUP\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\Office16\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\PackageManifests\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\Updates\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office 15\ClientX64\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Update Health Tools\Logs\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\defaults\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\fonts\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\META-INF\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\uninstall\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\MSBuild\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\af-ZA\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ar\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\az-Latn-AZ\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\bg\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\bs-Latn-BA\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ca-ES\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\cs\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\cy-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\da\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\de\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\el-GR\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\es\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\es-MX\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\et\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\eu-ES\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\fa-IR\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\fi\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\fr\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\fr-CA\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\gl-ES\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\he\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\hr\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\hu\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\id\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\is-IS\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\it\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ja\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ka-GE\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\kk-KZ\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ko\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\lt\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\lv\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ms-MY\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\nb\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\nl\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\nn-NO\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\pl\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\pt\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\pt-PT\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ro\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ru\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\sk\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\sl\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\sq-AL\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\sr-Cyrl-BA\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\sr-latn\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\sv\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\th\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\tr-TR\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\uk\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ux\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\vi\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\zh-hans\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\zh-hant\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Realtek\Audio\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\ar-sa\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\bg-bg\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\cs-sz\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\da-dk\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\de-de\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\el-gr\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\en-gb\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\en-us\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\es-es\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\es-mx\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\et-ee\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\fi-fi\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\fr-ca\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\fr-fr\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\he-il\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\hr-hr\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\hu-hu\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\it-it\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\ja-jp\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\ko-kr\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\Logs\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\lt-lt\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\lv-lv\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\nb-no\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\nl-nl\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\pl-pl\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\pt-br\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\pt-pt\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\ro-ro\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\ru-ru\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\sk-sk\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\sl-latn-rs\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\sl-si\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\sv-se\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\th-th\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\tr-tr\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\uk-ua\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\zh-cn\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\zh-tw\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\UNP\Logs\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Defender\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Defender\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Defender\Offline\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Defender\Platform\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Media Player\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Media Player\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Media Player\Media Renderer\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Media Player\Network Sharing\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Media Player\Skins\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Media Player\Visualizations\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows NT\Accessories\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows NT\TableTextService\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Photo Viewer\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Photo Viewer\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ClickToRun\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\OFFICE16\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Stationery\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\TextConv\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Triedit\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\VGX\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\VSTO\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\System\ado\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\System\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\System\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\System\msadc\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\System\Ole DB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Google\Chrome\Application\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\Client\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\Document Themes 16\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\fre\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\Integration\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\Licenses\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\Licenses16\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\loc\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\Office15\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\Office16\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\rsod\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\Stationery\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\Templates\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\vfs\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\vreg\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\Updates\Apply\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\Updates\Download\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\features\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\META-INF\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\VisualElements\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\defaults\pref\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ux\resources\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ux\static\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Realtek\Audio\HDA\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows NT\Accessories\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows NT\TableTextService\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PSReadline\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ar-SA\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\bg-BG\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\da-DK\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\de-DE\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\el-GR\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\es-ES\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\es-MX\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\et-EE\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fi-FI\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fr-CA\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fr-FR\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\he-IL\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\hr-HR\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\hu-HU\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\it-IT\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ja-JP\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ko-KR\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\lt-LT\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\lv-LV\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\nb-NO\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\nl-NL\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pl-PL\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pt-BR\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pt-PT\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ro-RO\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ru-RU\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sk-SK\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sl-SI\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sv-SE\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\th-TH\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\tr-TR\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\uk-UA\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\zh-CN\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\zh-TW\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\TextConv\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Triedit\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\VSTO\10.0\instructions_read_me.txt	Jump to behavior

Source: HkObDPju6Z.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: E:\cpp\calc\Bin\Release_x86_v143\minipath.pdb source: HkObDPju6Z.exe
Source:	Binary string: rocess-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.3.dr
Source:	Binary string: K0S\ship\lobiclient\x-none\EntityPicker.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000{ source: EntityPicker.dll.3.dr
Source:	Binary string: d:\dbs\el\may\target\x64\ship\osm\x-none\MSBARCODE.pdb0000000000000 source: MSBARCODE.DLL.3.dr
Source:	Binary string: D:\Extra\react\chakradbg\arm64\build\bin\x64\Release\ChakraCore.Debugger.pdbBB"! source: ChakraCore.Debugger.dll.3.dr
Source:	Binary string: G0.pdb source: api-ms-win-core-xstate-l2-1-0.dll.3.dr
Source:	Binary string: d:\dbs\el\may\target\x64\ship\osm\x-none\MSBARCODE.pdb source: MSBARCODE.DLL.3.dr
Source:	Binary string: ;\ship\intldate\x-none\IntlDate.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: INTLDATE.DLL.3.dr
Source:	Binary string: ;\ship\intldate\x-none\IntlDate.pdb source: INTLDATE.DLL.3.dr
Source:	Binary string: S\ship\lobiclient\x-none\EntityPicker.pdb source: EntityPicker.dll.3.dr
Source:	Binary string: d:\dbs\el\jul\target\x64\ship\click2run\x-none\Interceptor.pdb source: Interceptor.dll.3.dr
Source:	Binary string: d:\dbs\el\jul\target\x64\ship\click2run\x-none\Interceptor.pdb0000000000000000000000000000000000000 source: Interceptor.dll.3.dr
Source:	Binary string: D:\Extra\react\chakradbg\arm64\build\bin\x64\Release\ChakraCore.Debugger.pdb source: ChakraCore.Debugger.dll.3.dr

Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_0083605C FindFirstFileExW,	10_2_0083605C
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_007EE3D0 PathCompactPathExW,LoadStringW,LoadStringW,LoadStringW,SendMessageW,GetParent,DoDragDrop,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SHGetDataFromIDListW,FindFirstFileW,FindClose,StrFormatByteSizeW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetDateFormatW,GetTimeFormatW,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,wsprintfW,SendMessageW,wsprintfW,lstrcmpW,SendMessageW,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,StrRetToBufW,StrRetToBufW,StrRetToBufW,SHGetFileInfoW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,lstrcmpW,	10_2_007EE3D0
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_00836446 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	10_2_00836446
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02A4CB30 FindFirstFileW,lstrcmpW,FindNextFileW,GetLastError,FindClose,GetTempPathW,RegCreateKeyExW,GetTickCount,	10_2_02A4CB30
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02AD8642 FindFirstFileExW,	10_2_02AD8642
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02A4C4FE FindFirstFileW,lstrcmpW,FindNextFileW,GetLastError,FindClose,	10_2_02A4C4FE

Networking

Found Tor onion address

Source: HkObDPju6Z.exe, 00000003.00000003.22575159083.0000000002F20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: HkObDPju6Z.exe	String found in binary or memory: ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 26d371a9-efda-4e82-9989-01e292244d65 ! To access .onion websites downlo
Source: HkObDPju6Z.exe	String found in binary or memory: ATTENTION!Your network has been breached and all data was encrypted. Please contact us at:https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 26d371a9-efda-4e82-9989-01e292244d65! To access .onion websites downlo
Source: HkObDPju6Z.exe, 0000000A.00000003.22756871962.00000000028F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: HkObDPju6Z.exe, 0000000A.00000002.22779639838.0000000000D20000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: HkObDPju6Z.exe, 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: HkObDPju6Z.exe, 0000000E.00000002.22855902907.0000000002900000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: HkObDPju6Z.exe, 0000000E.00000003.22839485707.0000000002980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: HkObDPju6Z.exe, 0000000E.00000002.22856927512.0000000002A90000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: notepad.exe, 0000001E.00000002.27586886931.0000000003343000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt46.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt51.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt79.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt78.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt39.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt13.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt21.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt38.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt40.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt15.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt57.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt71.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt6.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt69.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt30.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt54.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt2.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt18.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: instructions_read_me.txt41.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/

Source: ChakraCore.Debugger.dll.3.dr	String found in binary or memory: http://crl.mi)
Source: C2RINTL.vi-vn.dll.3.dr, Interceptor.dll.3.dr, MSBARCODE.DLL.3.dr	String found in binary or memory: http://crl.mic
Source: inventory.dll.3.dr	String found in binary or memory: http://crl.mic&
Source: api-ms-win-crt-stdio-l1-1-0.dll.3.dr	String found in binary or memory: http://crl.micro
Source: api-ms-win-core-xstate-l2-1-0.dll.3.dr	String found in binary or memory: http://crl.micrpNi
Source: MAPISHELL.DLL.3.dr	String found in binary or memory: http://crl.miy
Source: ProjectPro2019VL_MAK_AE-pl.xrm-ms.3.dr	String found in binary or memory: http://www.microsoft.
Source: HkObDPju6Z.exe, 00000003.00000003.22622038049.0000000001070000.00000004.00000020.00020000.00000000.sdmp, C2RINTL.ru-ru.dll.3.dr, AccessR_Grace-ul-oob.xrm-ms.3.dr	String found in binary or memory: http://www.microsoft.c
Source: ProjectProCO365R_Subscription-pl.xrm-ms.3.dr, Access2021VL_MAK_AE-pl.xrm-ms.3.dr, Publisher2021R_Retail2-pl.xrm-ms.3.dr	String found in binary or memory: http://www.microsoft.co
Source: O365EduCloudEDUR_Subscription-pl.xrm-ms.3.dr	String found in binary or memory: http://www.microsoft.cog
Source: StartMenu_Win8.mp4.3.dr, StartMenu_Win10_RTL.mp4.3.dr	String found in binary or memory: http://www.videolan.org/x264.html
Source: ProjectPro2021VL_MAK_AE1-ul-oob.xrm-ms.3.dr	String found in binary or memory: http://www.w3.
Source: Publisher2019R_Retail-ul-oob.xrm-ms.3.dr	String found in binary or memory: http://www.w3.5(
Source: ProjectProCO365R_SubTest-ul-oob.xrm-ms.3.dr	String found in binary or memory: http://www.w3.L
Source: Standard2021MSDNR_Retail-ul-oob.xrm-ms.3.dr	String found in binary or memory: http://www.w3.i
Source: O365HomePremR_SubTrial4-ul-oob.xrm-ms.3.dr, Publisher2021R_Trial-ul-oob.xrm-ms.3.dr, Standard2021R_Retail-ul-oob.xrm-ms.3.dr, Access2021R_Retail-pl.xrm-ms.3.dr, ProPlusVL_KMS_Client-ul.xrm-ms.3.dr, Standard2019VL_MAK_AE-ul-phn.xrm-ms.3.dr	String found in binary or memory: http://www.w3.o
Source: O365HomePremR_SubTrial5-ul-oob.xrm-ms.3.dr	String found in binary or memory: http://www.w3.od9(
Source: O365HomePremR_SubTrial4-ul-oob.xrm-ms.3.dr, Access2021VL_MAK_AE-ul-oob.xrm-ms.3.dr, Standard2021R_Trial-ul-oob.xrm-ms.3.dr, Access2019VL_MAK_AE-ul-oob.xrm-ms.3.dr, ProfessionalR_Trial-ul-oob.xrm-ms.3.dr	String found in binary or memory: http://www.w3.or
Source: VisioPro2019R_Grace-ul-oob.xrm-ms.3.dr	String found in binary or memory: http://www.w3.orQZ
Source: Standard2019R_Grace-ul-oob.xrm-ms.3.dr	String found in binary or memory: http://www.w3.orRR
Source: Standard2021R_Grace-ul-oob.xrm-ms.3.dr	String found in binary or memory: http://www.w3.oro
Source: O365HomePremR_SubTrial5-ul-oob.xrm-ms.3.dr	String found in binary or memory: http://www.w3.orqq5
Source: HkObDPju6Z.exe, HkObDPju6Z.exe, 0000000A.00000003.22756871962.00000000028F0000.00000004.00001000.00020000.00000000.sdmp, HkObDPju6Z.exe, 0000000A.00000002.22779639838.0000000000D20000.00000004.00001000.00020000.00000000.sdmp, HkObDPju6Z.exe, 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, HkObDPju6Z.exe, 0000000E.00000002.22855902907.0000000002900000.00000004.00001000.00020000.00000000.sdmp, HkObDPju6Z.exe, 0000000E.00000003.22839485707.0000000002980000.00000004.00001000.00020000.00000000.sdmp, HkObDPju6Z.exe, 0000000E.00000002.22856927512.0000000002A90000.00000040.00001000.00020000.00000000.sdmp, notepad.exe, 0000001E.00000002.27586886931.0000000003343000.00000004.00000020.00020000.00000000.sdmp, instructions_read_me.txt46.3.dr, instructions_read_me.txt51.3.dr, instructions_read_me.txt79.3.dr, instructions_read_me.txt78.3.dr, instructions_read_me.txt39.3.dr, instructions_read_me.txt13.3.dr, instructions_read_me.txt21.3.dr, instructions_read_me.txt38.3.dr, instructions_read_me.txt40.3.dr, instructions_read_me.txt15.3.dr, instructions_read_me.txt57.3.dr, instructions_read_me.txt71.3.dr, instructions_read_me.txt6.3.dr	String found in binary or memory: https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Source: inventory.dll.3.dr	String found in binary or memory: https://clients.config.office.net/collec
Source: inventory.dll.3.dr	String found in binary or memory: https://docs.live-tst.net/skydocsservice.svc
Source: ProjectProCO365R_SubTest-ul-oob.xrm-ms.3.dr	String found in binary or memory: https://go.mJ
Source: ProjectPro2021VL_MAK_AE1-ul-oob.xrm-ms.3.dr	String found in binary or memory: https://go.mi
Source: O365HomePremR_SubTrial4-ul-oob.xrm-ms.3.dr	String found in binary or memory: https://go.mic
Source: O365HomePremR_SubTrial5-ul-oob.xrm-ms.3.dr	String found in binary or memory: https://go.micd1t
Source: Standard2021MSDNR_Retail-ul-oob.xrm-ms.3.dr	String found in binary or memory: https://go.microso
Source: Publisher2021R_Trial-ul-oob.xrm-ms.3.dr	String found in binary or memory: https://go.microsoft.c
Source: inventory.dll.3.dr	String found in binary or memory: https://graph.microsoft.us
Source: inventory.dll.3.dr	String found in binary or memory: https://graph.microsoft.uslogin.microsoftonline.ushttps://microsoftgraph.chinacloudapi.cnlogin.us3
Source: ProjectPro2021VL_KMS_Client_AE-ul-oob.xrm-ms.3.dr	String found in binary or memory: https://licensing.mic
Source: SkypeforBusiness2019R_Trial-ppd.xrm-ms.3.dr	String found in binary or memory: https://licensing.micro.
Source: Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.3.dr, O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.3.dr	String found in binary or memory: https://licensing.microso
Source: O365HomePremR_Subscription5-ul-oob.xrm-ms.3.dr	String found in binary or memory: https://licensing.microsoft
Source: Access2019VL_KMS_Client_AE-ul-oob.xrm-ms.3.dr, ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.3.dr	String found in binary or memory: https://licensing.microsoft.c
Source: inventory.dll.3.dr	String found in binary or memory: https://login.live.com/oauth20_authorize.srf
Source: inventory.dll.3.dr	String found in binary or memory: https://login.live.com/oauth20_desktop.srf
Source: inventory.dll.3.dr	String found in binary or memory: https://login.live.com/oauth20_token.srfhttps://8
Source: inventory.dll.3.dr	String found in binary or memory: https://login.live.com00000000480728C5T
Source: inventory.dll.3.dr	String found in binary or memory: https://login.mi7
Source: inventory.dll.3.dr	String found in binary or memory: https://login.microsoftonline.com/common
Source: inventory.dll.3.dr	String found in binary or memory: https://login.microsoftonline.com/commonSetAuthorityAttempted
Source: inventory.dll.3.dr	String found in binary or memory: https://login.microsoftonline.de/common
Source: inventory.dll.3.dr	String found in binary or memory: https://login.microsoftonline.de/commonmicrosoftonline.demicrosoftonline.mil3
Source: inventory.dll.3.dr	String found in binary or memory: https://login.windows.localPath
Source: inventory.dll.3.dr	String found in binary or memory: https://microsoftgraph.chinacloudapi.cn
Source: inventory.dll.3.dr	String found in binary or memory: https://odc.officeapps.l=
Source: inventory.dll.3.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/emailhrd/getidp
Source: inventory.dll.3.dr	String found in binary or memory: https://odc.officeapps.live.com/odc/emailhrd/getidp?domain=X-CorrelationIdX-Office-PlatformX-Officey
Source: inventory.dll.3.dr	String found in binary or memory: https://profile.live.com/home
Source: inventory.dll.3.dr	String found in binary or memory: https://substrate.office.com/profile/v1.0/me/profile
Source: inventory.dll.3.dr	String found in binary or memory: https://substrate.office.com/profile/v1.0/me/profileaccountspassportMemberNamephonesphoneNumbername
Source: HkObDPju6Z.exe	String found in binary or memory: https://www.flos-freeware.ch
Source: HkObDPju6Z.exe	String found in binary or memory: https://www.flos-freeware.chopenmailto:florian.balmer
Source: HkObDPju6Z.exe	String found in binary or memory: https://www.rizonesoft.com
Source: HkObDPju6Z.exe, HkObDPju6Z.exe, 0000000A.00000003.22756871962.00000000028F0000.00000004.00001000.00020000.00000000.sdmp, HkObDPju6Z.exe, 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, HkObDPju6Z.exe, 0000000E.00000003.22839485707.0000000002980000.00000004.00001000.00020000.00000000.sdmp, HkObDPju6Z.exe, 0000000E.00000002.22856927512.0000000002A90000.00000040.00001000.00020000.00000000.sdmp, notepad.exe, 0000001E.00000002.27586886931.0000000003343000.00000004.00000020.00020000.00000000.sdmp, instructions_read_me.txt46.3.dr, instructions_read_me.txt51.3.dr, instructions_read_me.txt79.3.dr, instructions_read_me.txt78.3.dr, instructions_read_me.txt39.3.dr, instructions_read_me.txt13.3.dr, instructions_read_me.txt21.3.dr, instructions_read_me.txt38.3.dr, instructions_read_me.txt40.3.dr, instructions_read_me.txt15.3.dr, instructions_read_me.txt57.3.dr, instructions_read_me.txt71.3.dr, instructions_read_me.txt6.3.dr, instructions_read_me.txt69.3.dr, instructions_read_me.txt30.3.dr	String found in binary or memory: https://www.torproject.org/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to modify clipboard data

Source: C:\Users\user\Desktop\HkObDPju6Z.exe

Code function: 10_2_007EBE50 GetFileAttributesW,GetFileAttributesW,MessageBeep,DialogBoxIndirectParamW,LocalFree,ShellExecuteExW,GetShortPathNameW,StrCatBuffW,StrCatBuffW,StrCatBuffW,StrCatBuffW,lstrlenW,GlobalAlloc,GlobalLock,lstrcpyW,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,SendMessageW,SendMessageW,SendMessageW,StrRetToBufW,PathRemoveBackslashW,PathIsSameRootW,SetFocus,SendMessageW,SendMessageW,SendMessageW,SendMessageW,PostMessageW,GetFocus,GetDlgCtrlID,GetDlgItem,SetFocus,GetDlgItem,SetFocus,PathFileExistsW,lstrcpyW,StrRChrW,PathIsRootW,SetCurrentDirectoryW,SendMessageW,SendMessageW,lstrcpynW,MessageBeep,lstrcpynW,PathIsRootW,PathIsRootW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,

10_2_007EBE50

Source: inventory.dll.3.dr

Binary or memory string: RegisterRawInputDevices

Source: C:\Users\user\Desktop\HkObDPju6Z.exe

10_2_007EBE50

Spam, unwanted Advertisements and Ransom Demands

Yara detected BlackBasta ransomware

Source: Yara match	File source: 10.3.HkObDPju6Z.exe.28f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.HkObDPju6Z.exe.2980000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.HkObDPju6Z.exe.2a90000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HkObDPju6Z.exe.2a40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.HkObDPju6Z.exe.2f20000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.HkObDPju6Z.exe.2a90000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HkObDPju6Z.exe.2a40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.HkObDPju6Z.exe.2980000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.3.HkObDPju6Z.exe.28f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.HkObDPju6Z.exe.2f20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000003.22756871962.00000000028F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.27586886931.0000000003343000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.22575159083.0000000002F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.22839485707.0000000002980000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.22856927512.0000000002A90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HkObDPju6Z.exe PID: 332, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HkObDPju6Z.exe PID: 1508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HkObDPju6Z.exe PID: 5560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: notepad.exe PID: 1352, type: MEMORYSTR

Found ransom note / readme

Source: C:\instructions_read_me.txt

Dropped file: ATTENTION!Your network has been breached and all data was encrypted. Please contact us at:https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 26d371a9-efda-4e82-9989-01e292244d65*!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us)*!* To restore all your PCs and get your network working again, follow these instructions:- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.Please follow these simple rules to avoid data corruption:- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself.Waiting you in a chat.

Jump to dropped file

May disable shadow drive data (uses vssadmin)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\HkObDPju6Z.exe	File dropped: C:\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	File dropped: C:\$WinREAgent\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	File dropped: C:\Intel\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	File dropped: C:\PerfLogs\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	File dropped: C:\Program Files\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	File dropped: C:\Program Files (x86)\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	File dropped: C:\ProgramData\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	File dropped: C:\Users\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	File dropped: C:\$WinREAgent\Scratch\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	File dropped: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\instructions_read_me.txt -> decrypt or rename the files will lead to its fatal corruption. it doesn't matter, who are trying to do this, either it will be your it guys or a recovery agency.please follow these simple rules to avoid data corruption:- do not modify, rename or delete files. any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - do not hire a recovery company. they can't decrypt without the key. they also don't care about your business. they believe that they are good negotiators, but it is not. they usually fail. so speak for yourself.waiting you in a chat.	Jump to dropped file

Deletes shadow drive data (may be related to ransomware)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: HkObDPju6Z.exe, 00000003.00000003.22575159083.0000000002F20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: HkObDPju6Z.exe, 00000003.00000003.22575159083.0000000002F20000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @xh.7878kr5jxC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet4
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: cmd.exe, 00000005.00000003.22578239684.0000000002BFF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ndows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: cmd.exe, 00000005.00000002.22583742097.0000000002B90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quietC:\Windows\system32\cmd.exeWinsta0\Default@
Source: cmd.exe, 00000005.00000002.22583742097.0000000002B90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\vssadmin.exexeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quietnsC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet=CWinsta0\DefaultpDa=::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\A\Registry\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySideiersC:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=computerComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\computerNUMBER_OF_PROCESSORS=16OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 158 Stepping 13, GenuineIn\Regi\Registry\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide:\Program Fi5
Source: cmd.exe, 00000005.00000002.22584071859.0000000003060000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\cmd.exe/cC:\Windows\SysNative\vssadmin.exedeleteshadows/all/quietUSER
Source: cmd.exe, 00000005.00000002.22584071859.0000000003060000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: indows\system32\cmd.exe c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: cmd.exe, 00000005.00000002.22583794298.0000000002BF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quietC:\Windows\system32\cmd.exeWinsta0\Default@
Source: cmd.exe, 00000005.00000002.22583794298.0000000002BF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: cmd.exe, 00000005.00000002.22583794298.0000000002BF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quietxJ
Source: cmd.exe, 00000005.00000002.22583794298.0000000002BF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: cmd.exe, 00000005.00000002.22583794298.0000000002BF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet=J
Source: vssadmin.exe, 00000007.00000002.22582396603.000002558A8A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\vssadmin.exeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quietC:\Windows\SysNative\vssadmin.exe delete shadows /all /quietWinsta0\DefaultZ
Source: vssadmin.exe, 00000007.00000002.22582396603.000002558A8A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: vssadmin.exe, 00000007.00000002.22582924443.000002558AB45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exedeleteshadows/all/quietl[T
Source: HkObDPju6Z.exe	Binary or memory string: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: HkObDPju6Z.exe, 0000000A.00000003.22756871962.00000000028F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: HkObDPju6Z.exe, 0000000A.00000003.22756871962.00000000028F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @xh.7878kr5jxC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet4
Source: HkObDPju6Z.exe, 0000000A.00000002.22778769878.0000000000A88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ws\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: HkObDPju6Z.exe, 0000000A.00000002.22778769878.0000000000A88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ws\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quietqIZ
Source: HkObDPju6Z.exe, 0000000A.00000002.22778769878.0000000000A88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: indows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quietVHR
Source: HkObDPju6Z.exe, 0000000A.00000002.22772911645.00000000005E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quietC:\Windows\system32\cmd.exeWinsta0\Default@
Source: HkObDPju6Z.exe, 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: HkObDPju6Z.exe, 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: xh.7878kr5jxC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet4
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: cmd.exe, 0000000B.00000002.22769798953.0000000002E50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quietC:\Windows\system32\cmd.exeWinsta0\Default@
Source: cmd.exe, 0000000B.00000002.22769798953.0000000002E50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: cmd.exe, 0000000B.00000002.22769798953.0000000002E50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: cmd.exe, 0000000B.00000002.22769798953.0000000002E50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: cmd.exe, 0000000B.00000002.22771243764.00000000034B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\cmd.exe/cC:\Windows\SysNative\vssadmin.exedeleteshadows/all/quietUSERA
Source: cmd.exe, 0000000B.00000002.22771243764.00000000034B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: indows\system32\cmd.exe c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: cmd.exe, 0000000B.00000002.22770295956.0000000002F60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quietC:\Windows\system32\cmd.exeWinsta0\Default@
Source: cmd.exe, 0000000B.00000002.22770295956.0000000002F60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\vssadmin.exexeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quietnsC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet=CWinsta0\DefaultpDa=::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\A\Registry\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySideiersC:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=computerComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\computerNUMBER_OF_PROCESSORS=16OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 158 Stepping 13, GenuineIn\Regi\Registry\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide:\Program Fi5
Source: vssadmin.exe, 0000000D.00000002.22767624761.0000021C52477000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: - Code: ADMPROCC00001737- Call: ADMPROCC00001712- PID: 00004644- TID: 00003096- CMD: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet - User: Name: computer\user, SID:S-1-5-21-3425316567-2969588382-3778222414-1001
Source: vssadmin.exe, 0000000D.00000002.22768372963.0000021C52695000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exedeleteshadows/all/quiet
Source: vssadmin.exe, 0000000D.00000002.22767624761.0000021C52470000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\vssadmin.exeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quietC:\Windows\SysNative\vssadmin.exe delete shadows /all /quietWinsta0\Default\
Source: vssadmin.exe, 0000000D.00000002.22767624761.0000021C52470000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: HkObDPju6Z.exe, 0000000E.00000002.22855289387.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ws\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: HkObDPju6Z.exe, 0000000E.00000002.22855289387.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: indows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet8D[
Source: HkObDPju6Z.exe, 0000000E.00000003.22839485707.0000000002980000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: HkObDPju6Z.exe, 0000000E.00000003.22839485707.0000000002980000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @xh.7878kr5jxC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet4
Source: HkObDPju6Z.exe, 0000000E.00000002.22852179285.0000000000740000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quietC:\Windows\system32\cmd.exeWinsta0\Default@
Source: HkObDPju6Z.exe, 0000000E.00000002.22856927512.0000000002A90000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: HkObDPju6Z.exe, 0000000E.00000002.22856927512.0000000002A90000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: xh.7878kr5jxC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet4
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: cmd.exe, 0000000F.00000002.22850487846.0000000002D10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quietC:\Windows\system32\cmd.exeWinsta0\Default@
Source: cmd.exe, 0000000F.00000002.22850487846.0000000002D10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\vssadmin.exexeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quietnsC:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet=CWinsta0\DefaultpDa=::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\A\Registry\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySideiersC:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=computerComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\computerNUMBER_OF_PROCESSORS=16OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 158 Stepping 13, GenuineIn\Regi\Registry\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide:\Program Fi5
Source: cmd.exe, 0000000F.00000002.22850628903.0000000002DA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quietC:\Windows\system32\cmd.exeWinsta0\Default@
Source: cmd.exe, 0000000F.00000002.22850628903.0000000002DA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: cmd.exe, 0000000F.00000002.22850628903.0000000002DA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: cmd.exe, 0000000F.00000002.22850628903.0000000002DA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quietV3
Source: cmd.exe, 0000000F.00000002.22851185178.0000000003270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\cmd.exe/cC:\Windows\SysNative\vssadmin.exedeleteshadows/all/quietUSER
Source: cmd.exe, 0000000F.00000002.22851185178.0000000003270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: indows\system32\cmd.exe c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: vssadmin.exe, 00000011.00000002.22848700588.000001451D255000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exedeleteshadows/all/quiet
Source: vssadmin.exe, 00000011.00000002.22847867711.000001451D085000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: - Code: ADMPROCC00001737- Call: ADMPROCC00001712- PID: 00008264- TID: 00006180- CMD: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet - User: Name: computer\user, SID:S-1-5-21-3425316567-2969588382-3778222414-1001
Source: vssadmin.exe, 00000011.00000002.22847867711.000001451D085000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: - Code: ADMPROCC00001737- Call: ADMPROCC00001712- PID: 00008264- TID: 00006180- CMD: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet - User: Name: computer\user, SID:S-1-5-21-3425316567-2969588382-3778222414-1001 1
Source: vssadmin.exe, 00000011.00000002.22847867711.000001451D050000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\vssadmin.exeC:\Windows\SysNative\vssadmin.exe delete shadows /all /quietC:\Windows\SysNative\vssadmin.exe delete shadows /all /quietWinsta0\Default2
Source: vssadmin.exe, 00000011.00000002.22847867711.000001451D050000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: vssadmin.exe, 00000011.00000002.22847867711.000001451D050000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysNative\vssadmin.exe delete shadows /all /quietv

Source: HkObDPju6Z.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_007D4B90	10_2_007D4B90
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_0081A184	10_2_0081A184
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_00804150	10_2_00804150
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_008182A6	10_2_008182A6
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_00804590	10_2_00804590
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_0081A5A5	10_2_0081A5A5
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_008485C0	10_2_008485C0
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_008185EE	10_2_008185EE
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_007EA800	10_2_007EA800
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_0081A9D5	10_2_0081A9D5
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_00818945	10_2_00818945
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_00818C8D	10_2_00818C8D
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_00830EC2	10_2_00830EC2
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_007E8FD0	10_2_007E8FD0
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_0081901B	10_2_0081901B
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_0080107A	10_2_0080107A
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_008193B8	10_2_008193B8
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_00819746	10_2_00819746
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_007F9931	10_2_007F9931
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_00819AAB	10_2_00819AAB
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_0083BAE1	10_2_0083BAE1
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_00803BD0	10_2_00803BD0
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_00801B51	10_2_00801B51
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_0083FDBC	10_2_0083FDBC
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_007F7DE3	10_2_007F7DE3
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_00819E1F	10_2_00819E1F
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02A4CB30	10_2_02A4CB30
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02A435D0	10_2_02A435D0
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02AC020C	10_2_02AC020C
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02AD6219	10_2_02AD6219
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02A88030	10_2_02A88030
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02A4E181	10_2_02A4E181
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02A6A190	10_2_02A6A190
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02A9A110	10_2_02A9A110
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02AD06BC	10_2_02AD06BC
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02A826E0	10_2_02A826E0
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02A9A610	10_2_02A9A610
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02A4C4FE	10_2_02A4C4FE
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02A90450	10_2_02A90450
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02AC059A	10_2_02AC059A

Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: String function: 007F3DA0 appears 64 times
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: String function: 00835B17 appears 36 times
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: String function: 00833118 appears 54 times

Source: C:\Users\user\Desktop\HkObDPju6Z.exe

Process Stats: CPU usage > 98%

Source: HkObDPju6Z.exe, 00000003.00000000.22535515296.00000000008EE000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameminipath.exeD vs HkObDPju6Z.exe
Source: HkObDPju6Z.exe, 0000000A.00000000.22714777048.00000000008EE000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameminipath.exeD vs HkObDPju6Z.exe
Source: HkObDPju6Z.exe, 0000000E.00000002.22854546352.00000000008EE000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameminipath.exeD vs HkObDPju6Z.exe
Source: HkObDPju6Z.exe	Binary or memory string: OriginalFilenameminipath.exeD vs HkObDPju6Z.exe

Source: C:\Windows\System32\vssadmin.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Section loaded: fdgmnfmfhdfgsndhfd.dll	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Section loaded: fdgmnfmfhdfgsndhfd.dll	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: edgegdi.dll	Jump to behavior

Source: HkObDPju6Z.exe	ReversingLabs: Detection: 59%
Source: HkObDPju6Z.exe	Virustotal: Detection: 69%

Source: C:\Windows\System32\vssadmin.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\HkObDPju6Z.exe C:\Users\user\Desktop\HkObDPju6Z.exe
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: unknown	Process created: C:\Users\user\Desktop\HkObDPju6Z.exe "C:\Users\user\Desktop\HkObDPju6Z.exe"
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: unknown	Process created: C:\Users\user\Desktop\HkObDPju6Z.exe "C:\Users\user\Desktop\HkObDPju6Z.exe"
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c start /MAX notepad.exe c:\instructions_read_me.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\notepad.exe notepad.exe c:\instructions_read_me.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\notepad.exe notepad.exe c:\instructions_read_me.txt	Jump to behavior

Source: C:\Windows\System32\vssadmin.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F2C2787D-95AB-40D4-942D-298F5F757874}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\HkObDPju6Z.exe

File created: C:\Users\instructions_read_me.txt

Jump to behavior

Source: C:\Users\user\Desktop\HkObDPju6Z.exe

File created: C:\Users\user\AppData\Local\Temp\fkdjsadasd.ico

Jump to behavior

Source: classification engine

Classification label: mal88.rans.spyw.evad.winEXE@21/1025@0/0

Source: C:\Users\user\Desktop\HkObDPju6Z.exe

Code function: 10_2_007E6080 CoCreateInstance,lstrcpyW,ExpandEnvironmentStringsW,lstrcpynW,

10_2_007E6080

Source: C:\Users\user\Desktop\HkObDPju6Z.exe

Code function: 10_2_007E2F30 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalFree,GetFocus,MessageBoxExW,LocalFree,LocalFree,

10_2_007E2F30

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7328:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7328:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2280:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2280:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4152:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2452:304:WilStaging_02
Source: C:\Windows\SysWOW64\notepad.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1352:168:WilStaging_02

Source: C:\Users\user\Desktop\HkObDPju6Z.exe

Code function: 10_2_007F132D LoadResource,

10_2_007F132D

Source: C:\Users\user\Desktop\HkObDPju6Z.exe

File created: C:\Program Files\instructions_read_me.txt

Jump to behavior

Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Command line argument: .	10_2_007E8650
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Command line argument: TaskbarCreated	10_2_007E8650
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Command line argument: .	10_2_007E8650
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Command line argument: TaskbarCreated	10_2_007E8650

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: HkObDPju6Z.exe

Static file information: File size 1489920 > 1048576

Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Google\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Internet Explorer\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office 15\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Update Health Tools\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\MSBuild\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Realtek\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Reference Assemblies\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Uninstall Information\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\UNP\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Defender\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Mail\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Media Player\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Multimedia Platform\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows NT\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Photo Viewer\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Portable Devices\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Security\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\WindowsPowerShell\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\DESIGNER\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\Services\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\System\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Google\Chrome\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Internet Explorer\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Internet Explorer\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Internet Explorer\images\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Internet Explorer\SIGNUP\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\Office16\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\PackageManifests\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\Updates\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office 15\ClientX64\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Update Health Tools\Logs\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\defaults\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\fonts\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\META-INF\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\uninstall\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\MSBuild\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\af-ZA\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ar\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\az-Latn-AZ\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\bg\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\bs-Latn-BA\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ca-ES\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\cs\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\cy-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\da\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\de\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\el-GR\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\es\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\es-MX\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\et\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\eu-ES\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\fa-IR\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\fi\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\fr\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\fr-CA\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\gl-ES\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\he\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\hr\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\hu\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\id\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\is-IS\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\it\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ja\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ka-GE\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\kk-KZ\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ko\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\lt\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\lv\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ms-MY\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\nb\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\nl\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\nn-NO\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\pl\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\pt\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\pt-PT\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ro\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ru\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\sk\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\sl\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\sq-AL\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\sr-Cyrl-BA\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\sr-latn\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\sv\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\th\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\tr-TR\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\uk\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ux\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\vi\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\zh-hans\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\zh-hant\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Realtek\Audio\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\ar-sa\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\bg-bg\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\cs-sz\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\da-dk\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\de-de\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\el-gr\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\en-gb\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\en-us\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\es-es\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\es-mx\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\et-ee\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\fi-fi\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\fr-ca\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\fr-fr\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\he-il\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\hr-hr\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\hu-hu\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\it-it\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\ja-jp\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\ko-kr\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\Logs\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\lt-lt\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\lv-lv\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\nb-no\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\nl-nl\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\pl-pl\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\pt-br\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\pt-pt\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\ro-ro\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\ru-ru\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\sk-sk\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\sl-latn-rs\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\sl-si\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\sv-se\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\th-th\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\tr-tr\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\uk-ua\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\zh-cn\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\ruxim\zh-tw\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\UNP\Logs\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Defender\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Defender\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Defender\Offline\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Defender\Platform\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\Classification\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Defender Advanced Threat Protection\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Media Player\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Media Player\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Media Player\Media Renderer\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Media Player\Network Sharing\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Media Player\Skins\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Media Player\Visualizations\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows NT\Accessories\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows NT\TableTextService\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Photo Viewer\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Photo Viewer\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ClickToRun\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\OFFICE16\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Stationery\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\TextConv\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Triedit\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\VGX\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\VSTO\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\System\ado\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\System\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\System\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\System\msadc\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\System\Ole DB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Google\Chrome\Application\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\Client\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\Document Themes 16\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\fre\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\Integration\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\Licenses\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\Licenses16\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\loc\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\Office15\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\Office16\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\rsod\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\Stationery\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\Templates\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\vfs\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\root\vreg\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\Updates\Apply\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Microsoft Office\Updates\Download\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\features\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\META-INF\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\browser\VisualElements\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\defaults\pref\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ux\resources\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\PCHealthCheck\ux\static\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Realtek\Audio\HDA\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Reference Assemblies\Microsoft\Framework\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows NT\Accessories\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows NT\TableTextService\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Windows Security\BrowserCore\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PackageManagement\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\Pester\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\WindowsPowerShell\Modules\PSReadline\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ar-SA\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\bg-BG\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\da-DK\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\de-DE\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\el-GR\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\es-ES\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\es-MX\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\et-EE\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fi-FI\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fr-CA\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fr-FR\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\he-IL\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\hr-HR\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\hu-HU\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\it-IT\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ja-JP\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ko-KR\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\lt-LT\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\lv-LV\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\nb-NO\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\nl-NL\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pl-PL\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pt-BR\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\pt-PT\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ro-RO\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\ru-RU\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sk-SK\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sl-SI\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\sv-SE\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\th-TH\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\tr-TR\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\uk-UA\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\zh-CN\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\ink\zh-TW\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\en-GB\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\TextConv\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\Triedit\en-US\instructions_read_me.txt	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Directory created: C:\Program Files\Common Files\microsoft shared\VSTO\10.0\instructions_read_me.txt	Jump to behavior

Source: HkObDPju6Z.exe	Static PE information: section name: RT_CURSOR
Source: HkObDPju6Z.exe	Static PE information: section name: RT_BITMAP
Source: HkObDPju6Z.exe	Static PE information: section name: RT_ICON
Source: HkObDPju6Z.exe	Static PE information: section name: RT_MENU
Source: HkObDPju6Z.exe	Static PE information: section name: RT_DIALOG
Source: HkObDPju6Z.exe	Static PE information: section name: RT_STRING
Source: HkObDPju6Z.exe	Static PE information: section name: RT_ACCELERATOR
Source: HkObDPju6Z.exe	Static PE information: section name: RT_GROUP_ICON

Source: HkObDPju6Z.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: HkObDPju6Z.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: E:\cpp\calc\Bin\Release_x86_v143\minipath.pdb source: HkObDPju6Z.exe
Source:	Binary string: rocess-l1-1-0.pdb source: api-ms-win-crt-process-l1-1-0.dll.3.dr
Source:	Binary string: K0S\ship\lobiclient\x-none\EntityPicker.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000{ source: EntityPicker.dll.3.dr
Source:	Binary string: d:\dbs\el\may\target\x64\ship\osm\x-none\MSBARCODE.pdb0000000000000 source: MSBARCODE.DLL.3.dr
Source:	Binary string: D:\Extra\react\chakradbg\arm64\build\bin\x64\Release\ChakraCore.Debugger.pdbBB"! source: ChakraCore.Debugger.dll.3.dr
Source:	Binary string: G0.pdb source: api-ms-win-core-xstate-l2-1-0.dll.3.dr
Source:	Binary string: d:\dbs\el\may\target\x64\ship\osm\x-none\MSBARCODE.pdb source: MSBARCODE.DLL.3.dr
Source:	Binary string: ;\ship\intldate\x-none\IntlDate.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: INTLDATE.DLL.3.dr
Source:	Binary string: ;\ship\intldate\x-none\IntlDate.pdb source: INTLDATE.DLL.3.dr
Source:	Binary string: S\ship\lobiclient\x-none\EntityPicker.pdb source: EntityPicker.dll.3.dr
Source:	Binary string: d:\dbs\el\jul\target\x64\ship\click2run\x-none\Interceptor.pdb source: Interceptor.dll.3.dr
Source:	Binary string: d:\dbs\el\jul\target\x64\ship\click2run\x-none\Interceptor.pdb0000000000000000000000000000000000000 source: Interceptor.dll.3.dr
Source:	Binary string: D:\Extra\react\chakradbg\arm64\build\bin\x64\Release\ChakraCore.Debugger.pdb source: ChakraCore.Debugger.dll.3.dr

Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107D3A8 pushad ; iretd	3_3_0107D3C9
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107D3A8 pushad ; iretd	3_3_0107D3C9
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107D3A8 pushad ; iretd	3_3_0107D3C9
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107D3A8 pushad ; iretd	3_3_0107D3C9
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107D3A8 pushad ; iretd	3_3_0107D3C9
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107D3A8 pushad ; iretd	3_3_0107D3C9
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107D3A8 pushad ; iretd	3_3_0107D3C9
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107D3A8 pushad ; iretd	3_3_0107D3C9
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107CF3E pushad ; iretd	3_3_0107CF6D
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107CF3E pushad ; iretd	3_3_0107CF6D
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107CF3E pushad ; iretd	3_3_0107CF6D
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107CF3E pushad ; iretd	3_3_0107CF6D
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107CF3E pushad ; iretd	3_3_0107CF6D
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107CF3E pushad ; iretd	3_3_0107CF6D
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107CF3E pushad ; iretd	3_3_0107CF6D
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107CF3E pushad ; iretd	3_3_0107CF6D
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_01077FD8 pushad ; retf	3_3_010783E1
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_01077FD8 pushad ; retf	3_3_010783E1
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_01077FD8 pushad ; retf	3_3_010783E1
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_01077FD8 pushad ; retf	3_3_010783E1
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_01077FD8 pushad ; retf	3_3_010783E1
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_01077FD8 pushad ; retf	3_3_010783E1
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_01077FD8 pushad ; retf	3_3_010783E1
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_01077FD8 pushad ; retf	3_3_010783E1
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_01077FD8 pushad ; retf	3_3_010783E1
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107ABF2 push ds; retf	3_3_0107ABF3
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107ABF2 push ds; retf	3_3_0107ABF3
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107ABF2 push ds; retf	3_3_0107ABF3
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107ABF2 push ds; retf	3_3_0107ABF3
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107ABF2 push ds; retf	3_3_0107ABF3
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 3_3_0107ABF2 push ds; retf	3_3_0107ABF3

Source: C:\Users\user\Desktop\HkObDPju6Z.exe

Code function: 10_2_007EA240 CreateWindowExW,LoadLibraryW,GetProcAddress,FreeLibrary,GetWindowLongW,SetWindowLongW,SetWindowPos,SendMessageW,SendMessageW,#410,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetSystemMetrics,CreateWindowExW,SendMessageW,SendMessageW,SHGetFileInfoW,SendMessageW,SendMessageW,SendMessageW,DragAcceptFiles,SendMessageW,SendMessageW,GetSystemMenu,DeleteMenu,DeleteMenu,DeleteMenu,GetMenuItemInfoW,SetMenuItemInfoW,LoadStringW,LoadStringW,LoadStringW,InsertMenuW,InsertMenuW,LoadStringW,LoadStringW,InsertMenuW,InsertMenuW,

10_2_007EA240

Source: initial sample

Static PE information: section name: .data entropy: 7.357984406581138

Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_007EFF10 GetSysColor,EnumWindows,IsWindowEnabled,IsIconic,ShowWindowAsync,IsWindowVisible,SendMessageW,SendMessageW,SendMessageW,SetForegroundWindow,GlobalSize,PathIsRelativeW,GetCurrentDirectoryW,PathAppendW,lstrcpyW,GlobalSize,SendMessageW,GlobalFree,LoadStringW,LoadStringW,LoadStringW,StrChrW,MessageBoxW,	10_2_007EFF10
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_007F04A0 lstrcpyW,lstrcpyW,EnumWindows,IsWindowEnabled,IsIconic,ShowWindowAsync,SetForegroundWindow,lstrlenW,GlobalAlloc,GlobalLock,lstrcpyW,GlobalUnlock,PostMessageW,StrChrW,MessageBoxW,GetShortPathNameW,StrCatBuffW,StrCpyNW,StrCatBuffW,StrCatBuffW,lstrcpyW,ShellExecuteExW,lstrcpynW,wsprintfW,DdeInitializeW,DdeCreateStringHandleW,DdeCreateStringHandleW,DdeCreateStringHandleW,DdeFreeStringHandle,DdeConnect,lstrlenW,DdeClientTransaction,DdeDisconnect,DdeFreeStringHandle,DdeFreeStringHandle,DdeFreeStringHandle,DdeUninitialize,GetShortPathNameW,StrCatBuffW,StrCpyNW,StrCatBuffW,StrCatBuffW,lstrcpyW,ExpandEnvironmentStringsW,lstrcpynW,ShellExecuteExW,DialogBoxIndirectParamW,LocalFree,	10_2_007F04A0
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_007F0AF0 lstrcpyW,EnumWindows,IsIconic,IsZoomed,SendMessageW,SetForegroundWindow,SetForegroundWindow,BringWindowToTop,SetForegroundWindow,GetSystemMetrics,GetWindowRect,GetWindowRect,GetWindowRect,EqualRect,SystemParametersInfoW,DrawAnimatedRects,SetWindowPos,	10_2_007F0AF0
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_007E8FD0 SetTimer,KillTimer,FindCloseChangeNotification,GetWindowPlacement,DragAcceptFiles,LocalFree,LocalFree,PostQuitMessage,DefWindowProcW,SendMessageW,DefWindowProcW,WaitForSingleObject,FindNextChangeNotification,SendMessageW,SetWindowPos,SetWindowPos,DefWindowProcW,ShowOwnedPopups,ShowOwnedPopups,SystemParametersInfoW,GetWindowRect,DrawAnimatedRects,ShowWindow,SetBkColor,SetTextColor,SendMessageW,SetWindowPos,RedrawWindow,IsIconic,ShowWindow,DragQueryFileW,DragQueryFileW,DragQueryFileW,DragFinish,GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,SetWindowPos,SendMessageW,SendMessageW,SendMessageW,DestroyWindow,DestroyWindow,DestroyWindow,DestroyWindow,GetClientRect,SendMessageW,SendMessageW,UpdateWindow,IsWindowVisible,LoadMenuW,GetSubMenu,SetForegroundWindow,GetCursorPos,SetMenuDefaultItem,TrackPopupMenu,PostMessageW,DestroyMenu,PostMessageW,ShowOwnedPopups,	10_2_007E8FD0
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_007ED9AB lstrcpyW,EnumWindows,IsIconic,IsZoomed,SendMessageW,SetForegroundWindow,SetForegroundWindow,BringWindowToTop,SetForegroundWindow,GetSystemMetrics,GetWindowRect,GetWindowRect,GetWindowRect,EqualRect,SystemParametersInfoW,DrawAnimatedRects,SetWindowPos,	10_2_007ED9AB

Source: C:\Users\user\Desktop\HkObDPju6Z.exe

Code function: 10_2_02A9E195 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

10_2_02A9E195

Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\HkObDPju6Z.exe

API coverage: 4.0 %

Source: C:\Users\user\Desktop\HkObDPju6Z.exe

Code function: 10_2_007F2503 VirtualQuery,GetSystemInfo,

10_2_007F2503

Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_0083605C FindFirstFileExW,	10_2_0083605C
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_007EE3D0 PathCompactPathExW,LoadStringW,LoadStringW,LoadStringW,SendMessageW,GetParent,DoDragDrop,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SHGetDataFromIDListW,FindFirstFileW,FindClose,StrFormatByteSizeW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetDateFormatW,GetTimeFormatW,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,wsprintfW,SendMessageW,wsprintfW,lstrcmpW,SendMessageW,CoTaskMemFree,CoTaskMemFree,CoTaskMemFree,StrRetToBufW,StrRetToBufW,StrRetToBufW,SHGetFileInfoW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,lstrcmpW,	10_2_007EE3D0
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_00836446 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	10_2_00836446
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02A4CB30 FindFirstFileW,lstrcmpW,FindNextFileW,GetLastError,FindClose,GetTempPathW,RegCreateKeyExW,GetTickCount,	10_2_02A4CB30
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02AD8642 FindFirstFileExW,	10_2_02AD8642
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02A4C4FE FindFirstFileW,lstrcmpW,FindNextFileW,GetLastError,FindClose,	10_2_02A4C4FE

Source: HkObDPju6Z.exe, 0000000A.00000002.22778769878.0000000000A88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxtray.exeUsers\
Source: HkObDPju6Z.exe, 0000000E.00000002.22855289387.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: HkObDPju6Z.exe, 0000000E.00000002.22855289387.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxservicek
Source: HkObDPju6Z.exe, 0000000E.00000002.22855289387.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxtray.exees(
Source: HkObDPju6Z.exe, 0000000E.00000002.22855289387.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxservice.exe
Source: HkObDPju6Z.exe, 0000000A.00000002.22778769878.0000000000A88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxserviceGW

Source: C:\Users\user\Desktop\HkObDPju6Z.exe

Code function: 10_2_00820E7D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

10_2_00820E7D

Source: C:\Users\user\Desktop\HkObDPju6Z.exe

10_2_007EA240

Source: C:\Users\user\Desktop\HkObDPju6Z.exe

Code function: 10_2_0083897F GetProcessHeap,

10_2_0083897F

Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_0082A542 mov ecx, dword ptr fs:[00000030h]	10_2_0082A542
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_00833B9D mov eax, dword ptr fs:[00000030h]	10_2_00833B9D
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_00833BE0 mov eax, dword ptr fs:[00000030h]	10_2_00833BE0
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_00833C23 mov eax, dword ptr fs:[00000030h]	10_2_00833C23
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_00833C7E mov eax, dword ptr fs:[00000030h]	10_2_00833C7E
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_00833D88 mov eax, dword ptr fs:[00000030h]	10_2_00833D88
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_00833DCC mov eax, dword ptr fs:[00000030h]	10_2_00833DCC
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_00833DFD mov eax, dword ptr fs:[00000030h]	10_2_00833DFD
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_00833D44 mov eax, dword ptr fs:[00000030h]	10_2_00833D44

Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_00820E7D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00820E7D
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_007F3225 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_007F3225
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_007F39B3 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_007F39B3
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_007F3B49 SetUnhandledExceptionFilter,	10_2_007F3B49
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02AB23C5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_02AB23C5
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: 10_2_02AB25C2 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_02AB25C2

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\notepad.exe notepad.exe c:\instructions_read_me.txt	Jump to behavior

Source: HkObDPju6Z.exe	Binary or memory string: Shell_TrayWnd
Source: HkObDPju6Z.exe	Binary or memory string: MAuxtheme.dllIsAppThemed - []\]%i %i%CSIDL:MYDOCUMENTS%.lnk"...%1%.2i"%s"Segoe UIMicrosoft JhengHei UIMicrosoft YaHei UIYu Gothic UIMalgun GothicWINDOWSTYLE;WINDOWShell_TrayWndTrayNotifyWndaf-ZA be-BY de-DE el-GR en-GB en-US es-ES es-MX fr-FR hi-IN hu-HU id-ID it-IT ja-JP ko-KR nl-NL pl-PL pt-BR pt-PT ru-RU sk-SK sv-SE tr-TR vi-VN zh-CN zh-TWTaskbarCreatedfdgmnfmfhdfgsndhfdMinPathNotepad3...AutoRefreshRateSysListView32ComboBoxEx32ToolbarWindow32Toolbar Labels%02i(none)msctls_statusbar32ReBarWindow32Toolbar -f0 -n -p %i,%i,%i,%iok\A-RHS%s \| %s %s \| %s%u-/%i,%i,%i,%iNotepad3.exe
Source: HkObDPju6Z.exe, 00000003.00000000.22534600236.000000000084E000.00000002.00000001.01000000.00000004.sdmp, HkObDPju6Z.exe, 0000000A.00000000.22713856029.000000000084E000.00000002.00000001.01000000.00000004.sdmp, HkObDPju6Z.exe, 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: M~uxtheme.dllIsAppThemed - []\]%i %i%CSIDL:MYDOCUMENTS%.lnk"...%1%.2i"%s"Segoe UIMicrosoft JhengHei UIMicrosoft YaHei UIYu Gothic UIMalgun GothicWINDOWSTYLE;WINDOWShell_TrayWndTrayNotifyWndaf-ZA be-BY de-DE el-GR en-GB en-US es-ES es-MX fr-FR hi-IN hu-HU id-ID it-IT ja-JP ko-KR nl-NL pl-PL pt-BR pt-PT ru-RU sk-SK sv-SE tr-TR vi-VN zh-CN zh-TWTaskbarCreatedfdgmnfmfhdfgsndhfdMinPathNotepad3...AutoRefreshRateSysListView32ComboBoxEx32ToolbarWindow32Toolbar Labels%02i(none)msctls_statusbar32ReBarWindow32Toolbar -f0 -n -p %i,%i,%i,%iok\A-RHS%s \| %s %s \| %s%u-/%i,%i,%i,%iNotepad3.exe

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Queries volume information: C:\instructions_read_me.txt VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	10_2_0083C076
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: EnumSystemLocalesW,	10_2_0083C381
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: EnumSystemLocalesW,	10_2_0083C318
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: ResolveLocaleName,GetLocaleInfoEx,	10_2_007E8460
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	10_2_0083C4A7
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: GetUserPreferredUILanguages,GetUserPreferredUILanguages,LocalAlloc,GetUserPreferredUILanguages,LocalFree,GetLocaleInfoEx,	10_2_007E84F0
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: EnumSystemLocalesW,	10_2_0083C41C
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: GetLocaleInfoW,	10_2_0083C6FA
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: GetLocaleInfoEx,SendMessageW,lstrlenW,ResetEvent,lstrlenW,CharPrevW,lstrlenW,CharPrevW,lstrlenW,	10_2_007E66E0
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	10_2_0083C823
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	10_2_0083C9F8
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: GetLocaleInfoW,	10_2_0083C929
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: EnumSystemLocalesW,	10_2_00832B14
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: EnumSystemLocalesW,	10_2_00832CA5
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: EnumSystemLocalesW,	10_2_00832C73
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: GetLocaleInfoW,	10_2_007F0EC9
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: LCIDToLocaleName,GetLocaleInfoEx,	10_2_007F114B
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: GetLocaleInfoW,	10_2_008335D2
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: GetLocaleInfoW,	10_2_02ADC284
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	10_2_02ADC353
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: GetLocaleInfoW,	10_2_02ADC055
Source: C:\Users\user\Desktop\HkObDPju6Z.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	10_2_02ADC17E

Source: C:\Users\user\Desktop\HkObDPju6Z.exe

Code function: 10_2_007F3BB6 cpuid

10_2_007F3BB6

Source: C:\Users\user\Desktop\HkObDPju6Z.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\HkObDPju6Z.exe

Code function: 10_2_00833611 GetSystemTimeAsFileTime,

10_2_00833611

Source: C:\Users\user\Desktop\HkObDPju6Z.exe

Code function: 10_2_02AD8178 GetTimeZoneInformation,

10_2_02AD8178

Source: C:\Users\user\Desktop\HkObDPju6Z.exe

Code function: 10_2_007E8650 GetVersion,SetErrorMode,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,GetSysColor,OleInitialize,InitCommonControlsEx,RegisterWindowMessageW,CreateSolidBrush,CreateSolidBrush,CreateSolidBrush,

10_2_007E8650

Source: HkObDPju6Z.exe, 00000003.00000003.22699680641.00000000044A4000.00000004.00000020.00020000.00000000.sdmp, HkObDPju6Z.exe, 00000003.00000003.22688330089.00000000044A4000.00000004.00000020.00020000.00000000.sdmp, HkObDPju6Z.exe, 00000003.00000003.22701642269.00000000044A4000.00000004.00000020.00020000.00000000.sdmp, HkObDPju6Z.exe, 00000003.00000003.22691417722.00000000044A4000.00000004.00000020.00020000.00000000.sdmp, HkObDPju6Z.exe, 00000003.00000003.22714149600.00000000044B6000.00000004.00000020.00020000.00000000.sdmp, HkObDPju6Z.exe, 00000003.00000003.22709498761.00000000044A4000.00000004.00000020.00020000.00000000.sdmp, HkObDPju6Z.exe, 00000003.00000003.22710230787.00000000044A4000.00000004.00000020.00020000.00000000.sdmp, HkObDPju6Z.exe, 00000003.00000003.22693481787.00000000044A5000.00000004.00000020.00020000.00000000.sdmp, HkObDPju6Z.exe, 00000003.00000003.22693632051.00000000044AA000.00000004.00000020.00020000.00000000.sdmp, HkObDPju6Z.exe, 00000003.00000003.22673821964.00000000044A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\\Program Files\Windows Defender\MsMpEng.exe
Source: HkObDPju6Z.exe, 00000003.00000003.22658154530.00000000044AC000.00000004.00000020.00020000.00000000.sdmp, HkObDPju6Z.exe, 00000003.00000003.22653448073.00000000044AC000.00000004.00000020.00020000.00000000.sdmp, HkObDPju6Z.exe, 00000003.00000003.22647199873.00000000044A6000.00000004.00000020.00020000.00000000.sdmp, HkObDPju6Z.exe, 00000003.00000003.22652004226.0000000004497000.00000004.00000020.00020000.00000000.sdmp, HkObDPju6Z.exe, 00000003.00000003.22656570562.00000000044A7000.00000004.00000020.00020000.00000000.sdmp, HkObDPju6Z.exe, 00000003.00000003.22655892664.00000000044A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	12 Process Injection	3 Masquerading	11 Input Capture	2 System Time Discovery	Remote Services	11 Input Capture	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Data Encrypted for Impact
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Proxy	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	11 Clipboard Data	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	3 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 DLL Side-Loading	Cached Domain Credentials	35 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 File Deletion	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
HkObDPju6Z.exe	59%	ReversingLabs	Win32.Ransomware.Basta
HkObDPju6Z.exe	69%	Virustotal		Browse
HkObDPju6Z.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://crl.mi)	0%	Avira URL Cloud	safe
http://www.w3.L	0%	Avira URL Cloud	safe
https://licensing.micro.	0%	Avira URL Cloud	safe
http://www.w3.orRR	0%	Avira URL Cloud	safe
https://www.flos-freeware.chopenmailto:florian.balmer	0%	Avira URL Cloud	safe
http://www.microsoft.co	0%	Avira URL Cloud	safe
http://www.microsoft.co	1%	Virustotal		Browse
https://odc.officeapps.l=	0%	Avira URL Cloud	safe
https://login.windows.localPath	0%	Avira URL Cloud	safe
http://www.w3.oro	0%	Avira URL Cloud	safe
https://login.mi7	0%	Avira URL Cloud	safe
http://www.w3.o	0%	Avira URL Cloud	safe
http://www.w3.od9(	0%	Avira URL Cloud	safe
http://www.microsoft.c	0%	Avira URL Cloud	safe
http://www.w3.i	0%	Avira URL Cloud	safe
https://docs.live-tst.net/skydocsservice.svc	0%	Avira URL Cloud	safe
https://go.mJ	0%	Avira URL Cloud	safe
https://graph.microsoft.uslogin.microsoftonline.ushttps://microsoftgraph.chinacloudapi.cnlogin.us3	0%	Avira URL Cloud	safe
https://go.microsoft.c	0%	Avira URL Cloud	safe
https://go.mic	0%	Avira URL Cloud	safe
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/	0%	Avira URL Cloud	safe
http://www.w3.orqq5	0%	Avira URL Cloud	safe
http://crl.mic	0%	Avira URL Cloud	safe
http://crl.miy	0%	Avira URL Cloud	safe
http://www.w3.or	0%	Avira URL Cloud	safe
http://www.microsoft.	0%	Avira URL Cloud	safe
https://go.micd1t	0%	Avira URL Cloud	safe
https://licensing.microsoft.c	0%	Avira URL Cloud	safe
http://www.w3.5(	0%	Avira URL Cloud	safe
http://www.microsoft.cog	0%	Avira URL Cloud	safe
https://go.microso	0%	Avira URL Cloud	safe
https://graph.microsoft.us	0%	Avira URL Cloud	safe
https://go.mi	0%	Avira URL Cloud	safe
http://crl.micro	0%	Avira URL Cloud	safe
http://crl.micrpNi	0%	Avira URL Cloud	safe
https://licensing.microso	0%	Avira URL Cloud	safe
https://licensing.microsoft	0%	Avira URL Cloud	safe
http://crl.mic&	0%	Avira URL Cloud	safe
http://www.w3.orQZ	0%	Avira URL Cloud	safe
https://licensing.mic	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.mi)	ChakraCore.Debugger.dll.3.dr	false	Avira URL Cloud: safe	low
https://licensing.micro.	SkypeforBusiness2019R_Trial-ppd.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
http://www.w3.orRR	Standard2019R_Grace-ul-oob.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
http://www.microsoft.co	ProjectProCO365R_Subscription-pl.xrm-ms.3.dr, Access2021VL_MAK_AE-pl.xrm-ms.3.dr, Publisher2021R_Retail2-pl.xrm-ms.3.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.flos-freeware.chopenmailto:florian.balmer	HkObDPju6Z.exe	false	Avira URL Cloud: safe	low
https://microsoftgraph.chinacloudapi.cn	inventory.dll.3.dr	false		high
http://www.w3.L	ProjectProCO365R_SubTest-ul-oob.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
https://www.torproject.org/	HkObDPju6Z.exe, HkObDPju6Z.exe, 0000000A.00000003.22756871962.00000000028F0000.00000004.00001000.00020000.00000000.sdmp, HkObDPju6Z.exe, 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, HkObDPju6Z.exe, 0000000E.00000003.22839485707.0000000002980000.00000004.00001000.00020000.00000000.sdmp, HkObDPju6Z.exe, 0000000E.00000002.22856927512.0000000002A90000.00000040.00001000.00020000.00000000.sdmp, notepad.exe, 0000001E.00000002.27586886931.0000000003343000.00000004.00000020.00020000.00000000.sdmp, instructions_read_me.txt46.3.dr, instructions_read_me.txt51.3.dr, instructions_read_me.txt79.3.dr, instructions_read_me.txt78.3.dr, instructions_read_me.txt39.3.dr, instructions_read_me.txt13.3.dr, instructions_read_me.txt21.3.dr, instructions_read_me.txt38.3.dr, instructions_read_me.txt40.3.dr, instructions_read_me.txt15.3.dr, instructions_read_me.txt57.3.dr, instructions_read_me.txt71.3.dr, instructions_read_me.txt6.3.dr, instructions_read_me.txt69.3.dr, instructions_read_me.txt30.3.dr	false		high
https://odc.officeapps.l=	inventory.dll.3.dr	false	Avira URL Cloud: safe	low
https://substrate.office.com/profile/v1.0/me/profileaccountspassportMemberNamephonesphoneNumbername	inventory.dll.3.dr	false		high
https://www.flos-freeware.ch	HkObDPju6Z.exe	false		high
http://www.w3.	ProjectPro2021VL_MAK_AE1-ul-oob.xrm-ms.3.dr	false		high
https://login.windows.localPath	inventory.dll.3.dr	false	Avira URL Cloud: safe	unknown
https://profile.live.com/home	inventory.dll.3.dr	false		high
http://www.videolan.org/x264.html	StartMenu_Win8.mp4.3.dr, StartMenu_Win10_RTL.mp4.3.dr	false		high
http://www.w3.oro	Standard2021R_Grace-ul-oob.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
https://login.mi7	inventory.dll.3.dr	false	Avira URL Cloud: safe	unknown
http://www.w3.o	O365HomePremR_SubTrial4-ul-oob.xrm-ms.3.dr, Publisher2021R_Trial-ul-oob.xrm-ms.3.dr, Standard2021R_Retail-ul-oob.xrm-ms.3.dr, Access2021R_Retail-pl.xrm-ms.3.dr, ProPlusVL_KMS_Client-ul.xrm-ms.3.dr, Standard2019VL_MAK_AE-ul-phn.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
http://www.w3.od9(	O365HomePremR_SubTrial5-ul-oob.xrm-ms.3.dr	false	Avira URL Cloud: safe	low
http://www.microsoft.c	HkObDPju6Z.exe, 00000003.00000003.22622038049.0000000001070000.00000004.00000020.00020000.00000000.sdmp, C2RINTL.ru-ru.dll.3.dr, AccessR_Grace-ul-oob.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
http://www.w3.i	Standard2021MSDNR_Retail-ul-oob.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
https://docs.live-tst.net/skydocsservice.svc	inventory.dll.3.dr	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/commonSetAuthorityAttempted	inventory.dll.3.dr	false		high
https://go.mJ	ProjectProCO365R_SubTest-ul-oob.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
https://graph.microsoft.uslogin.microsoftonline.ushttps://microsoftgraph.chinacloudapi.cnlogin.us3	inventory.dll.3.dr	false	Avira URL Cloud: safe	unknown
https://go.microsoft.c	Publisher2021R_Trial-ul-oob.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
https://go.mic	O365HomePremR_SubTrial4-ul-oob.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/	HkObDPju6Z.exe, HkObDPju6Z.exe, 0000000A.00000003.22756871962.00000000028F0000.00000004.00001000.00020000.00000000.sdmp, HkObDPju6Z.exe, 0000000A.00000002.22779639838.0000000000D20000.00000004.00001000.00020000.00000000.sdmp, HkObDPju6Z.exe, 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, HkObDPju6Z.exe, 0000000E.00000002.22855902907.0000000002900000.00000004.00001000.00020000.00000000.sdmp, HkObDPju6Z.exe, 0000000E.00000003.22839485707.0000000002980000.00000004.00001000.00020000.00000000.sdmp, HkObDPju6Z.exe, 0000000E.00000002.22856927512.0000000002A90000.00000040.00001000.00020000.00000000.sdmp, notepad.exe, 0000001E.00000002.27586886931.0000000003343000.00000004.00000020.00020000.00000000.sdmp, instructions_read_me.txt46.3.dr, instructions_read_me.txt51.3.dr, instructions_read_me.txt79.3.dr, instructions_read_me.txt78.3.dr, instructions_read_me.txt39.3.dr, instructions_read_me.txt13.3.dr, instructions_read_me.txt21.3.dr, instructions_read_me.txt38.3.dr, instructions_read_me.txt40.3.dr, instructions_read_me.txt15.3.dr, instructions_read_me.txt57.3.dr, instructions_read_me.txt71.3.dr, instructions_read_me.txt6.3.dr	true	Avira URL Cloud: safe	unknown
https://clients.config.office.net/collec	inventory.dll.3.dr	false		high
http://www.w3.orqq5	O365HomePremR_SubTrial5-ul-oob.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
http://crl.mic	C2RINTL.vi-vn.dll.3.dr, Interceptor.dll.3.dr, MSBARCODE.DLL.3.dr	false	Avira URL Cloud: safe	unknown
http://crl.miy	MAPISHELL.DLL.3.dr	false	Avira URL Cloud: safe	unknown
http://www.w3.or	O365HomePremR_SubTrial4-ul-oob.xrm-ms.3.dr, Access2021VL_MAK_AE-ul-oob.xrm-ms.3.dr, Standard2021R_Trial-ul-oob.xrm-ms.3.dr, Access2019VL_MAK_AE-ul-oob.xrm-ms.3.dr, ProfessionalR_Trial-ul-oob.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
http://www.microsoft.	ProjectPro2019VL_MAK_AE-pl.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
https://go.micd1t	O365HomePremR_SubTrial5-ul-oob.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
https://www.rizonesoft.com	HkObDPju6Z.exe	false		high
https://login.microsoftonline.de/common	inventory.dll.3.dr	false		high
https://licensing.microsoft.c	Access2019VL_KMS_Client_AE-ul-oob.xrm-ms.3.dr, ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
https://substrate.office.com/profile/v1.0/me/profile	inventory.dll.3.dr	false		high
http://www.w3.5(	Publisher2019R_Retail-ul-oob.xrm-ms.3.dr	false	Avira URL Cloud: safe	low
http://www.microsoft.cog	O365EduCloudEDUR_Subscription-pl.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
https://go.microso	Standard2021MSDNR_Retail-ul-oob.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
https://graph.microsoft.us	inventory.dll.3.dr	false	Avira URL Cloud: safe	unknown
https://go.mi	ProjectPro2021VL_MAK_AE1-ul-oob.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
http://crl.micro	api-ms-win-crt-stdio-l1-1-0.dll.3.dr	false	Avira URL Cloud: safe	unknown
http://crl.micrpNi	api-ms-win-core-xstate-l2-1-0.dll.3.dr	false	Avira URL Cloud: safe	unknown
https://licensing.microso	Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.3.dr, O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
https://licensing.microsoft	O365HomePremR_Subscription5-ul-oob.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
http://crl.mic&	inventory.dll.3.dr	false	Avira URL Cloud: safe	low
http://www.w3.orQZ	VisioPro2019R_Grace-ul-oob.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
https://licensing.mic	ProjectPro2021VL_KMS_Client_AE-ul-oob.xrm-ms.3.dr	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.de/commonmicrosoftonline.demicrosoftonline.mil3	inventory.dll.3.dr	false		high
https://login.microsoftonline.com/common	inventory.dll.3.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	886219
Start date and time:	2023-06-12 21:31:34 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 20m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	HkObDPju6Z.exe
Detection:	MAL
Classification:	mal88.rans.spyw.evad.winEXE@21/1025@0/0
EGA Information:	Successful, ratio: 50%
HDC Information:	Failed
HCA Information:	Successful, ratio: 79% Number of executed functions: 23 Number of non-executed functions: 252
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, VSSVC.exe, svchost.exe, TextInputHost.exe
Excluded IPs from analysis (whitelisted): 40.126.32.74, 40.126.32.68, 20.190.160.17, 40.126.32.72, 40.126.32.76, 20.190.160.14, 40.126.32.136, 40.126.32.138
Excluded domains from analysis (whitelisted): www.bing.com, spclient.wg.spotify.com, wdcpalt.microsoft.com, prdv4a.aadg.msidentity.com, login.live.com, www.tm.v4.a.prd.aadg.akadns.net, tile-service.weather.microsoft.com, wdcp.microsoft.com, array804.prod.do.dsp.mp.microsoft.com, login.msa.msidentity.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target HkObDPju6Z.exe, PID 332 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing behavior information.
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:33:39	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Skype C:\Users\user\Desktop\HkObDPju6Z.exe
21:33:47	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Skype C:\Users\user\Desktop\HkObDPju6Z.exe

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\$WinREAgent\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Intel\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\PerfLogs\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\AutoIt3\Include\AVIConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1897
Entropy (8bit):	7.545967015081844
Encrypted:	false
SSDEEP:	24:X7Ph1mw7QOvf7bphjL7qyp4ROso9hMJZrU2Kiybn5SVa/+aE8Nn7zq:X7p1b7P7thzqyEoArrH+jbNHq
MD5:	A3376EFC13EA76E8418AFFAE4C10AF46
SHA1:	37349D2AE75E1A6A0E9CB3A70E05A71BE7DED35F
SHA-256:	F362FC1A1AA0B22B8C29315A16FB6A02917B804755BBC9DE777D1394ECEDD72A
SHA-512:	422D73FC6254C40CC8E92657C269989FCD5AB631C3D4D93FC773DFDA4711EF9D792563AFA7356DE4FF5FAA0348079E8F0947AEAF3CF954BFE5AECBAEBD8106D1
Malicious:	false
Preview:	Y..+<..?.../.YV.Hh>...8....F...9.paj..A.......<..R.1...a......E.G.um.Lg...q.ia..n#..A....F...9.paj..A.......<..R.1...a......E.G.um.Lg...q.ia..n...(..[.l..cry..\...n..r........\|o..d.X....!?.Q`.....eh.w^.........b..cry..9..X......+....A,Z....V.@..'>..;...l.;..~2>........T.2_a^)5/..)...H../....M...bi...N......h..8z... .'`.#m0..\....j\-.cry..F...]......R.1...a......E.G.um.Lg...q.ia..n#..A....F...9.paj..A.......<..R.1...a......E.G.um.Lg...q.ia..n#..A....F...9.paj..A.......<..e......a..l.,.Y.um.Lg...q.ia..n#..A....F...9.paj..A.......<..R.1...a......E.G.um.Lg...q.ia..n#..A....F...9.paj..A.......<..R.1.."g...A...p..'2..z...?.tx...A...(....[.O%C\">6..?..E...B..;.M..x.\|.....X.w..$?..6...". \|...M...(..."...0=G.;......^...!..,.S..e.\|.....r....)<.25...l......Q...=...)..{$.mma..q...r..s..O.i..]0Z..T...w..$?..6...". \|...W...#......pEf.\|j..=...e..R..=.B.."Q$...H......EZ..5...l.;2.6s:...*...(..aPo.....9.......1..e.`..I0...^.X.;.....4...l......]...(...,..zWu.\|\|..L.

C:\Program Files (x86)\AutoIt3\Include\BorderConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	2434
Entropy (8bit):	7.71491997429176
Encrypted:	false
SSDEEP:	48:+/wYjw7iB3/oJywiXwY9Yi+3FnAwbS5xT+0:TyEiN/jDw8Y5eOl0
MD5:	030067596892F75F1329EA9A4E9D3DB4
SHA1:	ACC83016AA4313BE72475A38EF75ED7E1BA3A70B
SHA-256:	E004B6CD78DC3F90A7A96ACC6B7A22223C04B5A2AD1E6A3469F3BAE86C316CEF
SHA-512:	9B9DA9C51F61F627D9C711C9A4DA0526093BFD8DDAAB992EF841505D109F5A653C5EDE892D4083EC527ADDAAD55BB467F1DF01E56FAF0A2B1F2311B74D1C12D7
Malicious:	false
Preview:	.wn",..............rds..m...3.....-%.0.k.oWh.V&P.SWS.G`...+3.D...#=\|}.H...}...$...l..w.....3.....-%.0.k.oWh.V&P.SWS.G`...+3.D...#=\|}.H...}...$...[....A.. .....>6.7..\ .0.4X...........6O..S..>V$2.....z...7...d 7q.y.V{..V..>6.#.l...2..h..dQN....Bfz..R..0.{`.....!........zT$.e..u\|..v..u0.#.\.r+ ..t...CN.Ts...6I..E..lo24....}...$...l..w.....3.....-%.0.k.oWh.V&P.SWS.G`...+3.D...#=\|}.H...}...$...l..w.....3.....-%.0.k.oWh.V&P.SWS.G`...+3.D...#=\|}.H..M...Z....ls......3.....-%.0.k.oWh.V&P.SWS.G`...+3.D...#=\|}.H...}...$...l..w.....3.....-%.0.k.oWh.V&P.SWS.G`...+3.D...#=\|}.H...}...^...0A...[.....a..QQ.H..}./..V;].Zgd..2.G6M..O.:B...'........\...q.E{.?.^l.....~k.-..w.5..%P(.'$ .(}...n6.s{..\|a-`.....`...F....hs..a..3..K..._.b.7_r):..oM.+.).%..{63.;U..L(e..'........L...}....g.d@..}..^].$.\t>.7..;......^..nIK.:t..>=a......d....J....cr..p.....a..QQ.H..}./..f.*.....Z..Xb..<x..AR...0..`....K....b..\|.uA..v..0<.I..a.#../R#.+8G.p..Iwb.:S..j e..2........9..8Yr....cQ..}..^W.Y..

C:\Program Files (x86)\AutoIt3\Include\ButtonConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	4765
Entropy (8bit):	7.846326583221281
Encrypted:	false
SSDEEP:	96:unExTCnvyC+VnXTdxXqYD2LoPKk2STyZFtCc9WXBGbUFp:TC+VnXTdcYDNPH2fZYxp
MD5:	8D552000303D05D36186C1B8725F53FC
SHA1:	C7549EC912A06FE4E3134EF8EF6F9CAAB42479CC
SHA-256:	9A8B31F9F7ECD46A618E8FF329442A09021BA3B18AA6EF310055BBACA287DE7C
SHA-512:	F7037F1B966B625A95B3A685C248847AC215CCEE07BD869B832D0182479E0A34C8DA1E796C153DDF2CF69E83C96BCA6CB54B0C25FF9B29DF9AC090069FA62562
Malicious:	false
Preview:	..{......0c. ..zJp.*9...&zzjq./8.""V....w(.Zb....-.-..#..=.w.\|..%.....c=....MLm.^Jm..8gzjq./8.""V....w(.Zb....-.-..#..=.w.\|..%.....c=....ML].XW...i?gyb.<+.11E...>a......]d..d....A.>.....}....V.d ....AE~.n}k.d4 "-.w%.11E.....{..6...$+..u..l..t.%.a.."....K.?n.^...p..W8..cgeyb.su.zq.....\..&....x..3..j..n.t.....w....T..u.Y..P.$...#..ddg6".2B.pj.....\|.K....M{..h.....A.>.....1.....d .L...\|Z.CJm..8gzjq./8.""V....w(.Zb....-.-..#..=.w.\|..%.....c=....MLm.^Jm..8gzjq./8.""V....w(.Zb....-.-..#..=.w.\|..%.....c=....MLm.n}]..%y....FD.KLH....w(.Zb....-.-..#..=.w.\|..%.....c=....MLm.^Jm..8gzjq./8.""V....w(.Zb....-.-..#..=.w.\|..%.....c=....MLm.^Jm...P\|w..}p...,....&5..1....R..W..K..O.j.a...(...5.e .X....].$.?..iz.8".f%.]L4....X.Z..... ....q..l.../...<....}..E....@.`.SG]..i5%6 .Qj.lkK....P.7....{D..^..>..0.z.L...w....{.0s....#...%#p..5"wf\|....sp....%{......q]..D..W.. .j.9..(...W.?l.n....p.!$...V...../%.g/[....y..>..A~..0..M..U.......%....n..j....<. .>..%~....[B.K?V...

C:\Program Files (x86)\AutoIt3\Include\CUIAutomation2.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	47975
Entropy (8bit):	6.777862266680883
Encrypted:	false
SSDEEP:	768:FUkNoN3MqRLh0MbIJDpLnNbSOSzrS8aR1OAXx:7ePlnGpLnNbRayeGx
MD5:	01BFF50A243D43963A0A5DD015C5B12F
SHA1:	D41B8C4E1D426239E67F6A2DA0F2E4F7C48AEA71
SHA-256:	B13033695A59ACA2BECDF3F9EEABB3A9CB0A478377B9F63444EF12575C6D4B55
SHA-512:	5CE511ABAE4AE78D256C3660C3066FBBAC750C07A26C2EB0F60D9F0999C5DE5B10B561D006DFE62E7B65D7A15A00B9ED8CAE863F59CF1200512D992487A80B9E
Malicious:	false
Preview:	...1..o.'d.......+>....._z..@.,.u.-.H-........q*r..O..).X..083-8FB8-45CF-BCB7-C477ACB2F897}"....;CoClasses..Global Const $sCLSID_CUIAutomation = "{FF48DBA4-60EF-4201-AA87-54103EEF594E}".....(..7.X.o`+....6....D8...O;..^{@.}.........`!t.....0.\..0..Global Const $UIA_SelectionPatternId = 10001..Global Const $UIA_ValuePatternId = 10002..Global Const $UIA_RangeValuePatternId...t..Ot.k.lu3.$!.4.2j....c8..K/..R....O.....NA.....0....t $UIA_ExpandCollapsePatternId = 10005..Global Const $UIA_GridPatternId = 10006..Global Const $UIA_GridItemPatternId = 10007..Gl.......1.i#.GU....>;..u..N-...x1..c?D...r..t....u(&.....0.9.._WindowPatternId = 10009..Global Const $UIA_SelectionItemPatternId = 10010..Global Const $UIA_DockPatternId = 10011..Global Cons........#.%b.o`+....6..0.K.k..K8..K7D..R1....7....v(c.....q....nId = 10013..Global Const $UIA_TextPatternId = 10014..Global Const $UIA_TogglePatternId = 10015..Global Const $UIA_TransformPatt...d..sNy6.......+>....._z..M.6.X4..

C:\Program Files (x86)\AutoIt3\Include\Clipboard.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	19296
Entropy (8bit):	6.30998218992441
Encrypted:	false
SSDEEP:	384:q+ic5mRjnEBW2YdtEUGFpkrf7+Sx2hhcX5JuB0SOshWhX0X7PAowXoyt:qrRjEBW20ukHx2h6SVhWCPoXt
MD5:	A2687C7932D0F979F3F9BFB38F3F2A3A
SHA1:	DDC5D9035099304D450E6645D1D3A9C31F205041
SHA-256:	7B79095721B0CD692507CB9200F5DE378DDB63D09F5C763EA008385A5D2E46A1
SHA-512:	0D77E12983774373393B12F6565395D9EDCB70905003E404210E8FBB01CF1F152BE8B22E3A5C3EA3041E65180F0EFB5C232111409A7ECA7FD541C08CA9FA1BCF
Malicious:	false
Preview:	).$.z..Q4...9.Y.#w....k.J<.../.U.._jVW.....A-.k4.E.ik>.z.r....===========================================================================================================..; Title .........: I.#.t..F}..WNu. qIj.&.\|..p..s.....wAW."%w....N..K.zx-.}..NPMIsh..; Description ...: Functions that assist with Clipboard management...; The clipboard is a set of functions k..S{..Gx..N@.5j {...j..n...#.X..D*T..9qI....J.....5x..\|.o.... Because all applications have access to the clipboard, data can be easily transferred..; between az.&.u..]v.LN[.t>ww.../..p...0.E..^0.4.....#..G.....tx-.i.u.g@Ul Campbell (PaulIA)..; =========================================================================================================7.wN+...$..QS..i#=#.M....`%........d.'y.$8.._Y..L..X.ik>.z.r....===========================================================================================..Global Const $CF_TEXT = 1 ; Text fox.+...Xv..Nw.:mt>.3.M.>S.}.......4.

C:\Program Files (x86)\AutoIt3\Include\Color.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10272
Entropy (8bit):	6.307934892632479
Encrypted:	false
SSDEEP:	96:SpkKfY3Sr9SSCPTbVww2rxt+/va8WBLVURFIm2pRNb2iOrod0719DJO39fNrsw:SqKfY3qMnQ0Ha9EFIm2pRxYM417ODrD
MD5:	F978819F881AD42CB8C450C288356E58
SHA1:	7AC4B6BBD5F298B2FF0871740ED02ADCAF14BC9B
SHA-256:	497201C1DACCEBE4FBB3626CB27239B22D36DB2536AD034958228117E9E84780
SHA-512:	320F5A35D1C983BE9E715B3A056DC643D86674992426455875507CD25BB30437E679D1842CBB772823D7F7F22847246527BDB101AB6CBD61127CEC32975A0084
Malicious:	false
Preview:	..2#.............<X..C.@.. .h.%5.C....gV>...N..g.hz]......~.]D====================================================================================================================..; Title ...ErnH.BV....s.....C.........u..a..J...8.c.yF....4......p.ZYEnglish..; Description ...: Functions that assist with color management...; Author(s) .....: Ultima, Jon, Jpm..; ===============.Va}[.QQ..V..<....h.......\.!.Q\|..D...4.p.N@..P._\|@....c.]D================================================....; #CONSTANTS# ==============================================================.Va}[.QQ..V..<....h.......\.!.Q\|..D...4.p.N@..P._\|@...2.#.nst $__COLORCONSTANTS_HSLMAX = 240..Global Const $__COLORCONSTANTS_RGBMAX = 255..; =============================================.Va}[.QQ..V..<....h.......\.!.Q\|..D...4.p.N@..P._\|@....c.]D==================....; #CURRENT# ==============================================================================================.Va}[.QQ..V..<....h..../..>.s..3.C...}

C:\Program Files (x86)\AutoIt3\Include\ColorConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	2919
Entropy (8bit):	7.711975722239858
Encrypted:	false
SSDEEP:	48:YgERlwfyEuEgEVv4T2JFdAjLdESSGZTOjPoFtcJCGAer7FrgzSMK9x:OqfrXASJPG1ScSzMtc1rvEk9x
MD5:	A4A009944D14CC526874F4ACDE5EEB2B
SHA1:	AFA25CD4A266A476505AA729AB443D592AD59815
SHA-256:	4E9C3621FA86E1B1B9C3C6AC3BA314C1F5171DF6DECCB7F2FD8479A2DA6847C8
SHA-512:	EAC32014AA9212782E788770BD2E1DCB2BDFCD1B7C8A5A35FBCDA5393BB09D89C0BAE40F6B0916B95EB6F36E030B54FC5910F09A1FE7F1AE5EC0118CBC22C1D4
Malicious:	false
Preview:	;..I@.`;_...R.?0.(..+...E......d.aH..Be.......]l..v,..!..,;...%.....8+..b....5.oXvu..X......d.aH..Be.......]l..v,..!..,;...%.....8+..b......iE.!.........w.r[..<7\..VZ..m[...d..U6.Gc..Fw......68..R...~i.5./.K......y.2....0?..p...#..?x..<l.?<.@v..KB.%b_.....\Y^}.7.k!...k.WP..\|....;@..C...[q..?y..41.1(...6.``.asC....ANWz.r&2..6..M..w6.;.._v..=...]l..v,..!..,;...%.....8+..b....5.oXvu..X......d.aH..Be.......]l..v,..!..,;...%.....8+..b....5.oXvu..X......d.aH..Be.......m[..hR..O.._R...%.....8+..b....5.oXvu..X......d.aH..Be.......]l..v,..!..,;...%.....8+..b....5.oXvu..X......d.aH..Be.......]l..A...<..}i...[..YX.qe......WB?..>.)).&..Y......:..>.g.....Pa...W..[..sg..lw..^...JZ......qq.5.b.{x..U.. .OP;.0U...+F.t{..2....T..<r.!6..i^.m@.dz....,...qG..7....$....G...7.rRu..UU..#>..?1.S..CY..lP..k...5nv.....?0ud.0.'h.......`p.....>.....L..Xa..F...s .}&..Ak...o.JDo........8.bUsx..h..F.A^5......x...{{..,...k,..dr.W@.."...EN.%U_.....qu~G..(....+....[....C..u

C:\Program Files (x86)\AutoIt3\Include\ComboConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	8085
Entropy (8bit):	6.820140356592481
Encrypted:	false
SSDEEP:	192:rll+Sm7gUz8DrxGKo8HQHPo2NnggxD1vCm5:rlsYU4PlbQg2NXvCm5
MD5:	557B75BA9C260B34E2915439A2BBC9A2
SHA1:	493C87167FF5F27B299514847F41353230FDD0E3
SHA-256:	08F2EFC5F2AB4701D58F7C832E39E9FF7C672F1455967FE50932016433212812
SHA-512:	D8F2C56E843F3D5818429708A561D9F880334B86C88CB0C2BD717003557727FF6FB4D882132D9BF6EFF77A03B11AF1614E15E03C624E6015416F5F1D0CB8C0D3
Malicious:	false
Preview:	.........\|.'Q..,....D.DPB"..l)P.M$.Y.=.&..%L]WX.......h4c}==================================================================================..; Title .........: ComboBox_Constants..; Aut........G.?...r*.=...A...(..xS.6qM.^7.J.:.^..t...h......%}7/n ...: Constants for <a href="../appendix/GUIStyles.htm#Combo">GUI control Combo styles</a> and more...; Author(s) .....: Valik,.......A.....a$.1..q<..YPB"..l)P.M$.Y.=.&..%L]WX.......h4c}==============================================================================....; #CONSTANTS# ================================.........."...a$.1..q<..YPB"..l)P.M$.Y.=.&..%L]WX.......h4c}===================..; Error checking..Global Const $CB_ERR = -1..Global Const $CB_ERRATTRIBUTE = -3..Global Const $CB_ERRREQUIR.......$.p..A\|Z.b..hB..!?-Lv..QM.P4.i/G.t..tQ#...H.....P~} 0....; States..Global Const $STATE_SYSTEM_INVISIBLE = 0x8000..Global Const $STATE_SYSTEM_PRESSED = 0x8....; ComboBox Styles..Gl.......]..;..~.X.X....S..(MB?..e$M.PX..

C:\Program Files (x86)\AutoIt3\Include\Constants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	4547
Entropy (8bit):	7.730739147698964
Encrypted:	false
SSDEEP:	96:b2CXT2i2nnrj6qRL+QpDI0KvyK/OpUG2J/:R4rj6qvFBT8OpX2J
MD5:	B83F64F5443EB0DE4DF4CD644A5FC1F6
SHA1:	DC5428831F639A37A1401076759143527B9A770D
SHA-256:	C5C7C5F8D5A3443FDA383532A6FB87A7390927F0B0417EE19802D921D0A84EF5
SHA-512:	C4B5AACB4E4722BA1C26522DE0171C5126D7135CDCDA3E5AE5B94ED1B8134F83BE9F62CA4E96D1EB1B7143E3E738E7239D8E4914C31FF7121A3DAED56EF060F3
Malicious:	false
Preview:	..i.....K.c...............<..a".m.....Z^...O..r...p~...);....i........u....1.....}...<..V,.j.\...V2.V,.n..'\.H);....s....).#...g.........A... ..L9.0.....~...\...~..wu.^......i...........~.........W...=..C#.m.....y5..Q!.....Qh.n.:....t_............\.3..........n...p.#.O...I......&.8'...Wi.N..:L.......=../.K.........n...p.#.O...I......&.8'...Wi.N..:L.......=...2.........}.....p......2....t...S...D.:.I...4_..... ...g...........=..K>...I..\..O6.u.+ ..B.'....'....M.c...v........M...s..>.l.....~...J6.i...%4...Dn.9...c......P.t...Q...........4...m.0.....I......&.8'...Wi.N..:L.......=../.K.........n...p.#.O...I......&.8'...Wi.N..:L.......=../.K.........n...p.#.O...~2..a.U...KN...Wi.N..:L.......=../.K.........n...p.#.O...I......&.8'...Wi.N..:L.......=../.K.........n...p.#.O...I..2H..H...%n...5.S..u.......s...\|........\..7..K5.r......V..LO..;..Do..d......i....).....w........K...s..Gm.....

C:\Program Files (x86)\AutoIt3\Include\Crypt.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	27609
Entropy (8bit):	6.48513689704632
Encrypted:	false
SSDEEP:	384:BmyFQ4JH67/DiNwVE6U8vNYVUnZZP1DhBhvDloNfpR3UL8SoUN9aLZ:4yy0N+1YIuoXYLZ
MD5:	E0B573A4342B45F5D00084A0AFA7B60E
SHA1:	9A95EACBBC42ADAB57EC3C0B1C8944CEE1F5D848
SHA-256:	42F174DA9ACC5D12E4C61DABF9BDC7726BE6201FE48DA5C34E13804DAD8F571D
SHA-512:	EDD9D70BE54B9767966EC8F98886E7C347A2891EC736157579A351E546C3037ECA65079D9919442C5EE9336B775C93C136A1077C5E0B7259FA89548B6E1A24DA
Malicious:	false
Preview:	. H\|..=.[.%...kJ.exU/+i..l%]F^p..7.{4EB.E.....5x..@Is.$$../rror.au3"....; #INDEX# =========================================================================================================..s.-..-.......,hw.eh.d%e\|M.n0..#.. .\|....&{._.vB....J.pE..Y.14.5..; Language ......: English..; Description ...: Functions for encrypting and hashing data...; Author(s) .....: Andreas Kar..=D~.....[.Z.l>d..ai<@0k..lhm..-.Bw.&4...&j.f.e&...f..jX..W===========================================================================================================================....;...~B...D......"u...40.w6vo^=}#..>.Qd.5'...Z3..+Sk)...]V..wX..W================================================================..; _Crypt_DecryptData..; _Crypt_DecryptFile..; _Crypt_DeriveKey..u.O..`.\|.[.mx1h....jT. .p4Al^`..).L{PV?m5..U./d....V.:.i..e..; _Crypt_GenRandom..; _Crypt_HashData..; _Crypt_HashFile..; _Crypt_Shutdown..; _Crypt_Startup..; ============================..s.-..-......"u...40.w6vo^=}#..>.Qd.5

C:\Program Files (x86)\AutoIt3\Include\Date.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	83198
Entropy (8bit):	6.49010464492589
Encrypted:	false
SSDEEP:	768:qMGsIttPI2TQmjmPvu7EgprwQTbR+duUxxMlfcc3hKUbweHcm58HSpM4xm:qMGsIfo2WJ+TTb0qT9r5Kg9Y
MD5:	FFF4EB24DDD2237676FD0FD10F61D48A
SHA1:	3895C45A82F60A9CD282B851B4CE895269AB9A72
SHA-256:	A0B845107949E34441F36C52930C51A6ED1241580F90EA3BEEA60307459E5F58
SHA-512:	24193BAE0C2BA60DFF516D01A8D12FDBB609C267B7109923C65E150DBF5BA7DAA306333C105F762BB37B638BF65CC753C076030282EEFFFC39065786F47F66AA
Malicious:	false
Preview:	.:....t./<..'?..(f.6p......3.....Zv.....J/.}..K.\..s.:..+....ory.au3"..#include "Security.au3"..#include "StructureConstants.au3"..#include "WinAPIError.au3"..#include "WinAPIHObj.au3"..#in.?....F...$4fZ.gj.4i....:.gE..8..8.....<@5..{.B.-.r..6..^.=============================================================================================..; Title .........: Date..; AutoIt........zrGS....%:._'..P.. ....S..6.....Uh.`..}.;..s.&..b..C...: Functions that assist with Date/Time management...; There are five time formats: System, File, Local, MS-DO.s.....x.$=......bb.un...R..!......[k.....Ko](.+._..~.E..+.C. one of these formats. You can also use the time functions to convert between time formats for ease of..; .s...1.`rT]...f..'u...V..g......L......Mi.z..o.Q..>.u.o..O.jlandes, exodius, PaulIA, Tuape, SlimShady, GaryFrost, /dev/null, Marc..; ======================================================.n...,.}oI@....62.h!......z[...@..%..

C:\Program Files (x86)\AutoIt3\Include\DateTimeConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	7368
Entropy (8bit):	6.8152234061787995
Encrypted:	false
SSDEEP:	96:Wy3qguv8u1BhF3C9fVuX9dMo2dGdahgCkPkbVaFmsI1yEop2tv6Gj:WyaguEsBjeGahg38bUB32tyGj
MD5:	38460A57330C341347B40150ACA93071
SHA1:	2CE1187A7264C22202A15F9B2BEAAEB392AC4BC1
SHA-256:	81B3D654E785C28BA7C8260C5321F7FFFAEA3959AA6B639839EFA3608C508DF0
SHA-512:	D2223094D7E2056C177B523184C432229C943A50EB7331D07581FA3CB2A62F3D20A67609B72E05C70AABAFA69CB25AAA59129279769DE7E82BFD5896F3BB3CBA
Malicious:	false
Preview:	.....E...v.5..}7..2.E...w.4.....x.J.m....../....>...4."{..3==================================================================================..; Title .........: DateTime_Constants..; AutF..8U..v.v.#D...#."....t.h..QSX..k.Y.~...~.S~.....#.Y.j.v6..an ...: Constants for <a href="../appendix/GUIStyles.htm#Date">GUI control Date styles</a> and much more...; Author(s) .....: Val@..)Q._.9.wz0../.1....i.4.....x.J.m....../....>...4."{..3=================================================================================....; #CONSTANTS# =============================....S...$.k.>J.../.1....i.4.....x.J.m....../....>...4."{..3======================..; Date..Global Const $DTS_SHORTDATEFORMAT = 0..Global Const $DTS_UPDOWN = 1..Global Const $DTS_SHOWNONE ....dw...x.v.l.I..6.X.....M..atp....W.p.0.\|.[p.....p6..M.L...CEFORMAT = 9..Global Const $DTS_RIGHTALIGN = 32..Global Const $DTS_SHORTDATECENTURYFORMAT = 0x0000000C ; The year is a four-digit.....T...u.4.oWy.Ra.,.....Y..e\|o....W.p

C:\Program Files (x86)\AutoIt3\Include\Debug.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	27200
Entropy (8bit):	6.546339284293852
Encrypted:	false
SSDEEP:	384:M6RRIoNJW59vkp1IhlbGKP5MhtwKmYgc1Q0Q2UYv4MF9ZjHiWGEo:HWnvk/Ih70bnQ0oI4uHSEo
MD5:	BE253E248BAB1C25C52679A6B1A7C234
SHA1:	CD043FAB3DBA2AC2DB1D511053F03FDEBC9CFF22
SHA-256:	AEE358A456BB081CA773C1CA6BE9C6783D18610A5FF4A52BE47918F3A3B5F024
SHA-512:	9A8839E521CDC849EB29812E6154FD6579AC122B197AF06F5A5C4EB0958CDF009AFBF8D5F26CEF0D1D3D3370F3432577A375937DAC1968EA9BC63889DF7F5F71
Malicious:	false
Preview:	[D...+;...[...x...\|.Y.F{G4M.#..# $....[....L..i0....q...."AutoItConstants.au3"..#include "MsgBoxConstants.au3"..#include "SendMessage.au3"..#include "StringConstants.au3"..#include "Win9}....(5.Y.[...`@.^(x.Ey;{..gS....gTw..Z.........Y..S. ....==================================================================================..; Title .........: Debug..; AutoIt Version :X.....3Y.Q...t.....0B..Hw(\|..4....PRj....H..M.V..J..N.h...Uons to help script debugging...; Author(s) .....: Nutster, Jpm, Valik, guinness, water..; ======================================E.....;i.W.k.'.f]..-Q..[d;{..gS....gTw..Z.........Y..S. ....=========================....; #CONSTANTS# =====================================================================================E.....;i.W.k.'.f]..-Q..[d;{..P)..z%.......^.J...U..9.s...hext_Debug = "Debug Window hidden text"..; ======================================================================================E.....;i.W.k.'.f]..-Q..[d;{..gS....gT

C:\Program Files (x86)\AutoIt3\Include\DirConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1409
Entropy (8bit):	7.412938556318461
Encrypted:	false
SSDEEP:	24:z0frFQTAcfrFQ5lQsj0p+GAcfrFQTAcfrFvaAcfrFQTAcfrFQymEsLsw+ydvv84I:z0jFAFsSsuFAF0FAFNsLs9mvNUTbFAFA
MD5:	E0212FD91B1C515A5D3A212E0EC66E4D
SHA1:	FA0CC267099549EAA2547B160B7BFBF110008429
SHA-256:	9E18AD9A4A4EB9D06E211450DA2FCD7F782F40AB7ECA9116908CABF679B94DE1
SHA-512:	2B4789AA7F4AF64359BEAB1E818B2EA00C3FFD6B18A0A625DBA19CB34A1D0818858EA848F4E4BFA1E314CBF164B9E18028177EE9123306595876645558A075D4
Malicious:	false
Preview:	.H...U...]....#...:Z\^.K.).L...ts......h...U........3...81.................&..$./'...4.L...ts......h...U........3...81.................&...(2N.g.l._...g`....S.'w.............XjE..l..U..............."3^{.t.h.....g`...y.9A..e......~..Ck,.....e...E..@....L~..wp~o.v.)....i.....7.f..........{..Bb,..H.S...X.......on..va:i.3.'._..../.....P.'Q............81.................&..$./'...4.L...ts......h...U........3...81.................&..$./'...4.L...ts......h...U........3..&......h.............&..$./'...4.L...ts......h...U........3...81.................&..$./'...4.L...ts......h...U........3...81.0..I......@...jW.KPZS.V.4.AR..y~.......9G.........J..hL^..n..................u\|p{.3.f..^.......A.....X............@jn.....H.....l..{H.\3/:.k.9.A...yC....v.uk...........J..b%1.B.........t...B;.w`f:.W.E.#o........'.e...X.......o..ojb....b...t..a...;..)#".#.9.{m.+/.....d.u...$............5<....+............&..$./'...4.L...ts.....

C:\Program Files (x86)\AutoIt3\Include\EditConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	5148
Entropy (8bit):	7.795800976286432
Encrypted:	false
SSDEEP:	96:s2p757Y+Ofr50Ja5WoZdJnBKPAWhI1ixLparc:p5e0JtML+AWa1iNparc
MD5:	46B5AEC58E96123C171B1EAC98F58A31
SHA1:	3EEB3C6EF05CFDE02CFC52F7203363137B7B9C3D
SHA-256:	2F53876C0D30A436EAE93C0F65AED0D6882F93F9ABC4043D7B39508CB2CB4985
SHA-512:	8B8F025CA96E2BD7E7BEE0E7C763D24B0C95C287744562F137DE064391BA82C2E92FE6AB5B3C0935E2B39178D767842421E9F2942BF6C48878E4E34EC678136E
Malicious:	false
Preview:	q.....+\.t....XZT...8...q.....GS......WMN>jB.A.......?.._.o.....sL.'..o\I...A...q.....GS......WMN>jB.A.......?.._.o.....sL.'..o\y...(...Ml....T@.......)..p#........v...........nK.)....\|Ty...0...]-...T@........~.l_.....D...m..L.\|....<..'....".........a.........z....-%:#4.........v...'......+..5.....6A....\..Ml.........2.......q...\......T....~........i.....\|l~...A...q.....GS......WMN>jB.A.......?.._.o.....sL.'..o\I...A...q.....GS......WMN>jB.A.......?.._.o.....sL.'..o\I...q.........=......WMN>jB.A.......?.._.o.....sL.'..o\I...A...q.....GS......WMN>jB.A.......?.._.o.....sL.'..o\I...A.."w......c..S.....)..p#_.9...h...?..o..........i......"1.......A......N..Q.....9/!J.7.\... ..m..........".W....../1...H...D#..............:5!@.,.\... ..m..........".V.....21...M..o .............+# T.-.\.......n....r....j4.E....."&...\...A......N..Q.....9/2V.0./...a.."..Z.X.....n2.t......>:...8..dl.....p)..].

C:\Program Files (x86)\AutoIt3\Include\EventLog.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	32042
Entropy (8bit):	6.4708245454472735
Encrypted:	false
SSDEEP:	768:LBOZdCaSSjyLux5oSoubKy0HlJJLNItx98PHJfDADy:ozoSoxVP
MD5:	61115B439949D2EF878B12BC7381CF89
SHA1:	1171CA530AE5076D8B0607EDB8F229929738B69E
SHA-256:	217BE5838A8C2EBB1474EBBC634C3FF877520E7FD3E9508DB9B8F7B7C9121B86
SHA-512:	1E0913225A3F16AF3DEA25442B69D548847562340DF1B820D2402F39A20258730B9BDCE981CA5F96491BE3CB92C16D9AB41286A1C793C6322F819FD23449451F
Malicious:	false
Preview:	JQ....X.......B...K....BN+..W.p4..p"....9c9e;=.{..a..r.}.u8sj.include "StructureConstants.au3"..#include "WinAPIError.au3"..#include "WinAPIRes.au3"..#include "WinAPISys.au3"....; #INDEX# ==T..J.........u...H.B...S4.U..ch..o.....h+`=&".#.....6.!C{'C].=====================================================..; Title .........: Event_Log..; AutoIt Version : 3.3.14.5..; Language ...G..M..R.E...s....F....N.g.F..du.U<L.Q..ub5ao?.m..`..\.r.)m.@.ystem logs...; Description ...: When an error occurs, the system administrator or support technicians must determine what cause........L....E...U._...N).H..~u..3[.]...ub2 iz.q..a.e.<.)i.@.ata, and prevent the error from recurring. It is helpful if applications, the..; operating system, and othe......Y.....+....@......d..Q.?;..7Y.V...&c>h;~.>..d.n.s.?:...ditions or excessive..; attempts to access a disk. Then the system administrator can use the event log toI.......M....!...UR....-U).H..~u..r....

C:\Program Files (x86)\AutoIt3\Include\Excel.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	57934
Entropy (8bit):	6.658019826464878
Encrypted:	false
SSDEEP:	1536:SxOzsXRNbSWXnq6KE26ZBLHg0uZrgek8eIfm8p5raFriJCxrj756qG1aBEbc2:S4q/ZXnq6KE26ZBLHFuZrgekLUm8p5eM
MD5:	D986FB866E4ADE032EBD83DA7659C938
SHA1:	2E73C8ACFCA3A5045D989B01EDFA9B16EC109FE2
SHA-256:	23FB275792FB6D9FD3C73127CDFA82BCDC0E6C06F33637FDD5239BA328680B38
SHA-512:	479BADA3DA0BBE321C8332EE0412050B4398F587D34F0D83282E38EEDCB86F9AF40AC6324C93BD61393BE91CAD1B7BC7BDB7EB7DEC1B0DFEF1B58D2BD8BB9177
Malicious:	false
Preview:	...e.....oU.Y....o....QN.(.....Q6..u....p.....]4..q..@t..,.3"....Global $LastExcelCOMErroDesc = ""....; #INDEX# ===========================================================================..;.....=...90..<W.GO.S.TZQ....8..B..^.!......q>..W......q... Microsoft Excel Function Library..; AutoIt Version : 3.3.14.5..; Language ......: English..; Description ...: A collection of f...r....fT..en.r........G.....Qi....C.u......Qw..Q...f..,... Author(s) .....: SEO (Locodarwin), DaLiMan, Stanley Lim, MikeOsdx, MRDev, big_daddy, PsaltyDS, litlmike, water, spiff59, golfin..&....r^..C@..!+...Q..I......Hl..D....s......y.[..9;...b...=========================================================================================================================....; #...T....=...90..<W.GO.S.TZQ....8..B..^.!.......j.H...=...b...==============================================================..; _Excel_Open..; _Excel_Close..; _Excel_BookAttach..; _Excel_Boo...i... d.Dgh.C...>]..dmW....G`..=..

C:\Program Files (x86)\AutoIt3\Include\ExcelConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	19931
Entropy (8bit):	6.594933766785971
Encrypted:	false
SSDEEP:	384:eucAmPzQh/Wsgwg52/8MA1g/L81Nye51txue/aLew:GAT05MA1gD8ae7BTw
MD5:	37A6AE76D56E834A76AC0857466C3A73
SHA1:	9D8EFA50E69FA7056F69621A290A6A9C04AAB270
SHA-256:	C916C1BB0F481C772A2BA762961D5DF820A44C7B6270BD1B1C980C6036CC77A4
SHA-512:	66E6BDC0BDCE148549EC8E6DAAB150BC9651565DDC6333A932464BC94FAABC4E5725DFEAA58C8F79D32152746B002939BBF314921A40833416D60B57D4C7D069
Malicious:	false
Preview:	f.;..r~..[.bGU.x.,4...6.9.. ..9:=_[..R......s....T.d.......C:.==================================================================================..; Title .........: ExcelConstants..; AutoIt ..'..ht.../.v.A."..m.>..R..z.).LH..O.S...C...u..:.....[\^)..: Constants to be included in an AutoIt script when using the Excel UDF...; Author(s) .....: water..; Resources .....: Excel 20t.u..rw..U.hM6.O..`.&.]..F..3..guo..D.A.Y..;..X..8.......F?.5(v=office.14).aspx..; =========================================================================================================x.h..:'....<.e.H.).k...l?.>..JTT#(v.L......s....T.d.......C:.===========================================================================================..; XlAutoFilterOperator Enumeration.e.%..n\|..G.uJ=...rf."^...Z..n.ph ..Q...@....!...X..+...D^.b. by a filter...; See: http://msdn.microsoft.com/en-us/library/ff839625(v=office.14).aspx..Global Const $xlAnd = 1 ; Logical AND *.u..nn..].0.9...Tf."T.....Z..fflB%M...

C:\Program Files (x86)\AutoIt3\Include\FTPEx.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	45916
Entropy (8bit):	6.631269137746139
Encrypted:	false
SSDEEP:	768:q3onrQN1zjxumu9IwI1waJY4/+T2hov+qLTai:qiQNduywIqaJY2+ahoGSTx
MD5:	57C7534E363EE5CCFDB6AA1BDE2827A1
SHA1:	82D0ED9EA518797AFAB308D90BF54F483ACE2BA9
SHA-256:	9675455E9B4BC2DEF594517961C1D26A3C2552A6F1C4295972F4D7F0F2ED1714
SHA-512:	262289B852698DE8299F5727AC713DA1B0F56D438F4EFA4F2812EF15A0DDAC9B007E826C5123C6F25DCF608B968B9EB764F5A49D5A7DE0FF531B827A0D989E9F
Malicious:	false
Preview:	..H.-j....wpN...Y$.....z I..6C.F.... ..=.R..,..8.U..[.lK...q.O3"..#include "StructureConstants.au3"..#include "WinAPIConv.au3"..#include "WinAPIError.au3"....; #INDEX# ======================....\|".L.V$..<..Gp.]..."=V............n....t...l...U..%...b..=================================..; Title .........: FTP..; AutoIt Version : 3.3.14.5..; Language ......: English..; Descriptio...o%.7P.zgBn...%....li...5O.O.p....h....!.."...F..6...*._r, Prog@ndy, jpm, Beege..; Notes .........: based on FTP_Ex.au3 16/02/2009 http://www.autoit.de/index.php?page=Thread&postID=483..+.z?.L.V$..<..Gp.]..."=V............n....t...l...U..%...b..=====================================================================....; #VARIABLES# =========================================....\|".L.V$..<..Gp.]..."=V............n....t...l...U..%...b..==========..Global $__g_hWinInet_FTP = -1..Global $__g_hCallback_FTP, $__g_bCallback_FTP = False..; ============================....\|".L.V$..<..Gp.]..."=V............

C:\Program Files (x86)\AutoIt3\Include\File.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	44268
Entropy (8bit):	6.709693589202476
Encrypted:	false
SSDEEP:	768:mykPkjd7XIWliN+lgzD8Jhy73MPN0ZAZfTZmeIDdtp0Wz7:Osjd/iNMgUJw73IN0UmeIDbuWz7
MD5:	8131E0D17A70C1953C744CDDF40AF9E5
SHA1:	7FB7C515CD752A9EE5B19B233512FCAA11D8F31F
SHA-256:	DCFE586EF8530EDE2B833F45F52CB0C8D9BBEC84BA6D2EA381AF79D2F5931A6B
SHA-512:	1C87B4DF51149C43F1F8969D985E322F16F07DC7818A1A043440BDB5FE6F08520ABFBDDF6D8E2E0A893FA0EF4731A326E62889464CE11BD5C9047E00D0458419
Malicious:	false
Preview:	85....l.y.......+k.....1..F...x.1fn..y...Q......k..rQ<U.@.._u3"..#include "StringConstants.au3"....; #INDEX# ===============================================================================&a..V..4.+..E....8.W...,.......$Z?y^...k.p..N... ..2.f.X..ZRe..; AutoIt Version : 3.3.14.5..; Language ......: English..; Description ...: Functions that assist with files and directories..V...a.d..Q.....l?.(......Q...9k'..\|A..G......g..oJd.([...JdeB, Jeremy Landes, MrCreatoR, cdkid, Valik, Erik Pilsits, Kurt, Dale, guinness, DXRW4E, Melba23..; ===========================&a..V..4.+..E....8.W...,.......$Z?y^..-\.........3..!.u._....====================================....; #CURRENT# ============================================================================&a..V..4.+..E....8.W...,.......$Z?y^..-l...G..{..PK&Q.9..._FileCreate..; _FileListToArray..; _FileListToArrayRec..; _FilePrint..; _FileReadToArray..; _FileWriteFromArray..; _FileWriteLog.V..4.e.A........,`.`..A..\.....m9d<.

C:\Program Files (x86)\AutoIt3\Include\FileConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	6995
Entropy (8bit):	6.8295069312709344
Encrypted:	false
SSDEEP:	96:KmGr0nRyRKqwRf4/UMB2OWj6Rf3PiV/t3wvoS6seYtUBH5qFv1oM8:Km3R0KqwRg/U82ODI1wvC5qFv1of
MD5:	62E29CED03FC1DD443E7080B7B5C9083
SHA1:	1ABBA31436880E9CE51F00BA08AB06776F07BC5C
SHA-256:	4939D7F9DF430C753402350D35B1467A266A66D073E081007BFA39D753132AA3
SHA-512:	DB87D105F2EE3737B469EF3E1FE3CF4642E08A87D9A41EAC4213C98255E8F64909F99FEA5BFE1049D2DC59A876657BB007EEF584BA8F8B9D089BFF9C546972B9
Malicious:	false
Preview:	..U@..^K....1.....C.ErJ...........8G.6x.......MV..b0.....==================================================================================..; Title .........: File_Constants..; AutoIt ...EE..\.......1.1..aD.*..........%?.l).........6}......: Constants to be included in an AutoIt v3 script when using File functions...; Author(s) .....: Valik, Gary Frost, .....; ====........[.........7..=.Tb..........8G.6x.......MV..b0.....===========================================================....; #CONSTANTS# ===================================================........[.........7..=.Tb..........8G.6x.......MV..b0.......; Indicates file copy and install options..Global Const $FC_NOOVERWRITE = 0 ; Do not overwrite existing files (default)..Globa..YB..B...~...u.O.. .Id.......BI.`..x1........f..3b......st $FC_CREATEPATH = 8 ; Create destination directory structure if it doesn't exist....; Indicates file date and time options..Gl...Z...U......d...u.C. .Io.......WB.%.

C:\Program Files (x86)\AutoIt3\Include\FontConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	3920
Entropy (8bit):	7.790799057106601
Encrypted:	false
SSDEEP:	48:6AUEfs0uJLhDwKUBUYBSgInfpTY6OV8u35b/6nPyBRqLMJmBPU9YicPalFF9pSCf:64fsLDlUz0fJYxvb6q24kBc9YillFhh
MD5:	B17AE8020A7D1DB046C22AEFC777651A
SHA1:	1CEC7BCC3EFFB46ADB1D3D443B77C1A11BB820A7
SHA-256:	625A44440C339B7AD67403451F1578DA00646C28E6B792E0FCDA0E590E15A3F5
SHA-512:	648EBE64D1DA40F94A762DE204FABEF74A02E6B65ACCE0F9667DF3BF6F78707F369709630767AFC31FD383CA5EB4B7CEC24B6569BF1737303C9A269B53FB3FCE
Malicious:	false
Preview:	.....D"C...l....C.\V......<.4.=m..E ..R.&....D9....).a...N...Y..Z.zS.C.4'..2.^.(%..\|...<.4.=m..E ..R.&....D9....).a...N...Y..Z.zS.C.4'..2.n7.8..5F.../.'..~..B=...WD....j..&..4.)@Ne......NgT.M.:4.!.n7.8../M..d.'..~..B=...Or.....Y@..H..d.5[O.]...D..S3....)\|../..Sa8../I..o@'..k...i....h....W.l..m..FN_....D..Z.zS.C.4'..2.^.(%..\|...<.4.=m..E ..R.&....D9....).a...N...Y..Z.zS.C.4'..2.^.(%..\|...<.4.=m..E ..R.&....D9....).a...N...i..m.gM.1.ZN..[.@.(%..\|...<.4.=m..E ..R.&....D9....).a...N...Y..Z.zS.C.4'..2.^.(%..\|...<.4.=m..E ..R.&....D9....).a...N...Y..Z.Jd.^.ft....$Qzz..ai..u.-.W...6I..=f;.....>h..J.W.2GU.W..0.).zN.N.....`..Q5[..2^..VlL.T.z.1Z..O.;.....>h..J.W.2GU.W..1.5a.'.6.)'.?.n7Rt.. F..o@}.$.l.4T..;.&.....sC..I..4.3ZRXS...;.5m.".C.=....Rwy..E...!.O._.~.-Q..O.;.....>h..J.W.2GU.W..)..u.N.^.9.H.._tt...D...%u^.S.v.:R..O.;.....>h..J.W.2GU.W.. ..b.".^.),...$Qzz..ai..u.-.W.y.4Y..O.+.....f.....z.(..j$...0..%o..C.1....Rwy..E...!.O._.w.\.

C:\Program Files (x86)\AutoIt3\Include\FrameConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	2382
Entropy (8bit):	7.651398665206537
Encrypted:	false
SSDEEP:	48:tdGVdYtQdGVdIdGVdG5sJ0Ra7BD4ZFwUvXmXZ74eYvV/XHMr3kEoj/8CCJUldGVO:tdQdYtQdQdIdQde47BsZFwUvXYZ7VYvZ
MD5:	C25CAF6145849C5F8DF305F17FB29CE6
SHA1:	5A9D79C5733EBFE174B422DA7A6F60A84CD15547
SHA-256:	D94C71A910AE0842506E1E7691610B4E383A3DF3A35EA75CBB6AADA54392095E
SHA-512:	B1C30E601A199F95EC5911AB1F0DFE650F870C7B4CB8A07DAE45BF4FA19C6B839A817DEB7C2BF35ABC059E64F85C17E0E2F20EE47A842524CE7A2F5CA7C09ACB
Malicious:	false
Preview:	@2w.M...w.<!e9;..A...S..c..-......!;jT=(...:3...q7y...0.3...d^f$..@B.gRo.=....\.q...}..-......!;jT=(...:3...q7y...0.3...d^f$..@B.gRo.=....l.w.C..,K.>......2(mIFg.Y.XM.Q8k..........^-C.\|.R...zUrq.....T.F.7...I.q.D....2(yS P.S.n}..(w......~....7wMu#.b.....<6s.W...>.%.V...j.q.g.P._i9.rz...)......0...%.'...9wY{^.S._.(.!6.>...\.q...}..-......!;jT=(...:3...q7y...0.3...d^f$..@B.gRo.=....\.q...}..-......!;jT=(...:3...q7y...0.3...d^f$..@B.gRo.=....k.l.T...z.^.r....!;jT=(...:3...q7y...0.3...d^f$..@B.gRo.=....\.q...}..-......!;jT=(...:3...q7y...0.3...d^f$..@B.gRo.=....\.A.,..9^.0.G..O.qcZcGy.V.k..L?~d.N.L....Yy^{-.+:..8.>bC[_...E...H...z._.......A;.bt...h`..hN....H.[....S$7v.@._.5.!6 .u...1...G...{.-....z.sd6. V.Z.s...d.U....A......Ti`9.O...;.r1tUE.....8.r..2O.u.+.R.}jwo{.@.#J.q.H....C.]....7dCka.,w8.5.3. w^..A...T...{.D.o..x.W&jI0m.9.@b.C ....y.....H.6.M.o-..Oob0L...&.#.v..A.c....{.OY.<TA.z.FJ..q*t.....b....7..5j..Y;..<..U`e... ...^...k.-....0.[j8.a

C:\Program Files (x86)\AutoIt3\Include\GDIPlus.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	305135
Entropy (8bit):	6.394178807129197
Encrypted:	false
SSDEEP:	3072:Jg/XOc2B1NNSkbN5k/pWI0VFF8oFphjwPWVDui9YmrHFBPOJNxx:JGU1Ok00DD3hjtC3x
MD5:	965C1BCCC92ACADF16571006E216AB80
SHA1:	E46A26AB16C21D4C8929F92BBE46A7E501987C64
SHA-256:	C6AD4809DA41118DBB31A3F70F7D962A91076BBB51F32DB642B7D0ED32EE056F
SHA-512:	6960ADD37A19235B0B1A5E4CFD96D9EC2CB1B717CCB2D3AC68986AD19EE4166C46CDADB917244A7FEA8441E590D2C207AE12BE02B2F112765EA1A63AA0F26B9E
Malicious:	false
Preview:	.....".."....(M/.Q.w.X..G.z..".....(f.U.(....^uy.\.6J....).ctureConstants.au3"..#include "WinAPICom.au3"..#include "WinAPIConv.au3"..#include "WinAPIGdi.au3"..#include "WinAPIHObj.au3"..#Z....#../%.2...A.(... .u.d.q........t5...tP...ik-...~....Af.==============================================================================================..; Title .........: GDIPlus..; AuG....6#...#.S...]h......C.%b$M..6....g&.......'>.....K..../.on ...: Functions that assist with Microsoft Windows GDI+ management...; It enables applications to use graphic@K..@ ...-.....V.>...3....#>B..'...-a.V.(....0vd.Z.3\...u..; Applications based on the Microsoft Win32 API do not access graphics hardware directly...; z...."..?..X..V.4.Q..3....#.O..2....?m.U.&....<7\|...%.....8.tions...; GDI+ can be used in all Windows-based applications...; GDI+ is new technology that i@K...3...l....L.).A..C....#>B......:

C:\Program Files (x86)\AutoIt3\Include\GDIPlusConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28347
Entropy (8bit):	6.920400114882896
Encrypted:	false
SSDEEP:	768:6yQVOxNufTxrpmktSgZZDpcP89KvuB0MxNvH:QVOxsH3ZEP89+OxlH
MD5:	50CD288A03BA7A44DA6715E46F22B48C
SHA1:	2CCDA71D2799086FB3FAA7F8F18AA7FE4BF2C3D2
SHA-256:	D34F8B58FBC7A4E934121EB0459C842EA943F115BCAE933A325BECB303C789C7
SHA-512:	9D66FAF2CF9F305022B61BCEE23D1537623923E5D01671D865078A17E46C74BE0B350DA744908ED743C85D238ABDD39991E46FEEA84E06DE8138E1090449A12E
Malicious:	false
Preview:	FE....G.%.\|.(...x..<p.^C..'..L..D.....]UZ....[..[x...... ==================================================================================..; Title .........: GDIPlus_Constants..; Auto,X....P.g.2.m.....l..r..1...o...Q..W....%..K.E.k.." ....RLs ...: Constants for GDI+..; Author(s) .....: Valik, Gary Frost, UEZ..; =========================================================X..._...5B/.p.....e..E..@^..'..L..D.....]UZ....[..[x...... ======....; #CONSTANTS# ========================================================================================================X..._...5B/.G...x.........c...\|.f.....#..T...!..u9......}o\T = 0 ; A square cap that squares off both ends of each dash..Global Const $GDIP_DASHCAPROUND = 2 ; A circular cap that rounds o.J....K.m.v.m.....;....F.pi..u...Q.N...$!7x.w....u2........=3 ; A triangular cap that points both ends of each dash....; Pen Dash Style Types..Global Const $GDIP_DASHSTYLESOLID = 0 ; A sol.H....F..8~./....6...\r.43..[...%.m<..

C:\Program Files (x86)\AutoIt3\Include\GUIConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1323
Entropy (8bit):	7.485417162172661
Encrypted:	false
SSDEEP:	24:Lkotvs++P3/Cgun3RTlkotkonAASoxJ1oZJRodJQw6+ptzKhEP3MkNTHFoffQjJ/:LkotpiPCb31lkotkojSoz1oBo3QIFKTK
MD5:	DEA2F731E1900838930E03F5785A2D9D
SHA1:	9139EDCEE123E3AC3B09752CF166719D1A373720
SHA-256:	F4B156FE88728A6BBE099C7715452CB60F46F266BE00A28C443726642B00FFC1
SHA-512:	3EF6C2594D04772D150FAAC53AEB5EC66D9DD4251ED366098D40B97D70EB57DC3FE285617929C7DCC0559CB494214F4CFE7C4711FFEF39FFA32BE70A39BF130E
Malicious:	false
Preview:	q^...1.Ni....R.V@..rNB.0zx<...T.P....%.nCY^..g...?..].G).o..o.Z..y..yDB.e.aF...=;.Ude<...T.P....%.nCY^..g...?..].G).o..o.Z..y..yDB.e.aF... R..5=!...G.C......t.s91.4O..v..j.ZU.&.v&.1..7.DYE.k.mO..6.=.$86f....C.....8.=.....W6...g.....`.=..\|.I....E7.....x.4...Xah..<xt..IG.H.....8.#.....U....@..`.=..!.G.j..~Y)...3.\|...6.=.,54!...G.C.......h^Y^..g...?..].G).o..o.Z..y..yDB.e.aF...=;.Ude<...T.P....%.nCY^..g...?..].G).o..o.Z..y..yDB.e.aF...=;.Ude<...T.P....%.nsnn..3R..f..B.,].=.L&V...j.^w[r..6.0...."D..-7o...D.R.....+.^tG..6I.. .....W.<.K3Y...%..ftu...;.)....Dg...1l....C.].....m.qsn@..9P..".....W.<.K3Y...%..ftu...;.)....GS.+66r...C(D......p....>Y...k.."..W.<.K3Y...%..ftu...;.)....Lo...1d....C.].....m.qsn@..9P..".....f.!.\|=Y...*.Xj.....R.5...Ndc.J.1b...D.S....l.}..P..P...n....XG.;.Z t...0.E0.Q..z.VX..Xls..yzR...S.S....l.}..P..P...n....X@.0.P<D...0..%.L.{.2..._e&.<+=d...s.R....k.2.WA..yU..w..@./d.=.QConstants.au3"..#include "WindowsConstan

C:\Program Files (x86)\AutoIt3\Include\GUIConstantsEx.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	4363
Entropy (8bit):	7.843845537237017
Encrypted:	false
SSDEEP:	96:+DakxIyhUSWVd+0AGn9gcLOiUoNIfrGEUB+tMb:AveSyDAG9ZyKSzGEIUG
MD5:	E37935DD7B9AFC8DE2F25FD5820331BA
SHA1:	9CB758A062EEF9CAD1D3172F9317965CDC99B952
SHA-256:	95EA7554BB8A1F962C339B10223FBD7C6BEA56632FFCB59CCADB932DB758C5AF
SHA-512:	2E470BCA392A1C47FD60E53D8802C78DFEBB5010840315C7BB188298FED3DB58F565676D62461BB90E33ABDC8FB7F5AAD1AB901F69F97CEEA96CC9737F8696F0
Malicious:	false
Preview:	..di.f....c.6.Hh.9!...o.2......h...;......{PGj(vs..WK1......X..77.....-.=....n.'U...../......h...;......{PGj(vs..WK1......X..77.....-.=....n6.S...C.w......{...<.g..].5..9a8.Z.`M,.B.E..E.xy.\|...0.....lf6.S...Y.gLT....{...<.\..[..`pl5.+Q...\|.^.D..K..I.}..~.s.O.. 6.o....^.2jf..V.%.L.g..]....LVZ.`?&M.B.%......_..zg.3...y.......?.4F.....<....:.n...;......{PGj(vs..WK1......X..77.....-.=....n.'U...../......h...;......{PGj(vs..WK1......X..77.....-.=....n.'U...../......h./.......\|..,4.Fhn..WK1......X..77.....-.=....n.'U...../......h...;......{PGj(vs..WK1......X..77.....-.=....n.'U...../......h...;..8.w.#..$5 F.....V.O..o..eh.....~.t......~L-...d.\j.....e......T..^.oM(2a><L.J.,.^.M..E.od.=..\|.b.W..-=HnH...~.W{v..h...d.&......#..%{8nC.J.~.V......cd.}..x. .M..6sZt....C.\|IV..^.3.W.g..]..?.Kg=;z)/N.).b.C....,.\O.G...^. ...H.Wu....t.\|^G..p...`.C..m..}..MGw8xC(...n.[.i......M.Z...U.T.v....r@-......'t.DU.9.f.h.....g..(,.[..p.9"C.r....P..Mf.q..S.n.O....rE-...c._lk.f~.....+..

C:\Program Files (x86)\AutoIt3\Include\GuiAVI.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11564
Entropy (8bit):	6.344057182824136
Encrypted:	false
SSDEEP:	192:njMY2D8uHFUC1EfXafZyBv1V9utWQJZJ9Rt8nVTofJfZozvnSX0Pf98w09:jMY08uHFd1EfXafZA9PQJZJ9Rt8VTofD
MD5:	D0FD168E72C37C5E5668EE5D09844B38
SHA1:	E52D712694657C1808972EFDD8DE69C6850E76D6
SHA-256:	667B54F8EAAB26B20E1CB5EFB62C7BEC12B1C8F86282AB79E1657CD7BC6BBD78
SHA-512:	F1FFC1CB7D60C3A3EE9DEF5E08F158399861B94E037A845748556879051B84B6CD4972F6110EC8BBF1D62983628FDDF968DC8595AD56C87BC9191D32D9680BD6
Malicious:	false
Preview:	I.T..j..#/..dD.l....+......A.....T.......d.Gt...Y,....>.^..u3"..#include "SendMessage.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"..#include "WinAPIInternals.au3"..#includeJNmu.^..]9..o=......f...\..~.X.p......{.Y ....u.....n.....==============================================================================================..; Title .........: Animation..; +.Ns.k..k2..n'.[..U.f..K.7...v.R......h.!s.._ ....6.O..tion ...: Functions that assist with AVI control management...; An animation control is a window that displays ...].{..#...d&.(....$.......V...1.\..........D~...!....6.E...; of bitmap frames like a movie. Animation controls can only display AVI clips that do not contain audio. O..7..?...`.!i.A..[.h.......ye..t..Z..S.../...t...O'....s._... indicate system activity during a lengthy operation. This is..; possible because the operation thread ..Th.q..}`..d*......?.......re..X..Y...T

C:\Program Files (x86)\AutoIt3\Include\GuiButton.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28807
Entropy (8bit):	6.4004339815395035
Encrypted:	false
SSDEEP:	768:IVKPk3JYygVz06zOLNtRl1PWcHl7qL043b3biX+W:kKshk4
MD5:	86DE7972532180C2018BB1813738C4FA
SHA1:	C6931A3454A520B0584CD48286C8C60CE48B3AB8
SHA-256:	7BA8C8722490136BFE6796FB021AF27735AC179CF5310AAD4052A6DBBE035ADA
SHA-512:	B431F32357B9C151C9AC6BE7123B496B5367CCCA263F82BD95DC50FD3790EFC04A28B1CDDC4EEFD1DA2DFFA0A167B2623EEAAB15D7A13F58BF161F2041D70532
Malicious:	false
Preview:	.+...Q#k;.....K..Z...;w. .S.u.N/].r(.. 8Z..q.I..O.Nz...W.....nConstants.au3"..#include "SendMessage.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"..#include "WinAPIIcons.au3"...+...Q#k6..........}...-\|.n.-.R..a8..g....R~..s.~...U.2...HQ.N..======================================================================================================..; Title .........: Butto.Oq.e2zy..F..3.......q!.3.-.*..L~.o;...66...}.m..d.Ec..Txf.S..scription ...: Functions that assist with Button control management...; A button is a control the user can clic.b...T5a`...../....@..12.r.o.D.I.]./Q...n+...n.~...U.2...HQ.N..========================================================================================================....; #VARIABLES# ======..F..z3+.[..\|.......b/.?.>....Q..<a...n+...n.~...U.2...HQ.N..=============================================..Global $__g_hButtonLastWnd....; =================================================..F..z3+.[..\|.......b/.?.>....Q..<a..

C:\Program Files (x86)\AutoIt3\Include\GuiComboBox.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	41939
Entropy (8bit):	6.11908417106541
Encrypted:	false
SSDEEP:	768:I3NC5UrTgdtsau0k2J5hRK62L/VOJgJFGP7bfx7dOk2SzvW4K6ujKKhCXz9aVlJq:+M+GC7+l+G
MD5:	7ED9BFC80CFD179277DC7C1C6BC8BF0A
SHA1:	454003F97371E382D13247B62CB6D720F3169950
SHA-256:	92DDE6052FBF3067B756EC5B59966BD6BB881A704336DF7D2CA3DE295572398D
SHA-512:	41DDF60C053080157A0012A48426C42527CF19942C19B72B0986E77C72E5E95ED90AD6D8C80B0060959214F5040AA2E587617E5AAE0F69A511F197F640F1DB75
Malicious:	false
Preview:	)Z.%...v.........%F.......p'.e....O..pH.NU.S.....`...h.HennZ.. stants.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3(>.e..........\|IVf..$.M.B..E.$..".I..>...Z.0..`C.`...b..4.f]..C...; #INDEX# ===================================================================================================================7..{ro.3.....<&(...h.Y.t.^.E..L..P.kH.)@.6..jY.`.?.[i.3...D; Language ......: English..; Description ...: Functions that assist with ComboBox control management...; Author(s) .....: gafroyG.f/.........{c.%..{.^....u.:..\|..M.#..]..]..$..3.1.Uz.:...s====================================================================================....; #VARIABLES# ==========================7..{BX........./5;...{.^....u.:..\|..M.#..]..]..$..3.1.Uz.:...s=========================..Global $__g_hCBLastWnd....; =========================================================================7..{BX........./5;...{.^....u.:..\|..M.#.

C:\Program Files (x86)\AutoIt3\Include\GuiComboBoxEx.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	49651
Entropy (8bit):	6.12250870768078
Encrypted:	false
SSDEEP:	768:mfpPuoO5L33Idhj1tbrzvY5EtjFAucFpZBFYr5UUJEcmohKfSCvCG6PHzchFzzBG:4433chdul6R
MD5:	2B9DE08A2D703574F6E176D18B2FC189
SHA1:	1E67A9187C1DBA849E9F70AC388C47B6F1C50136
SHA-256:	7B11CCC0D49960EBC9D55B05CBD3965728D30D3D9CF16B73E53F852B5D4762B0
SHA-512:	1FE7B766D3772194DFEC0C1C169DE3A05369605B21AA97490262411C2B681583833708B1CC9A7390317B1AA9BC4D7A013631F0EE7322F33B16E7067C00764575
Malicious:	false
Preview:	S..r.=........D(.M......\|..vM:6,.K(...Y%e?.!I...)H2....G.G....nBox.au3"..#include "Memory.au3"..#include "UDFGlobalID.au3"..#include "WinAPIGdi.au3"..#include "WinAPISysInternals.au3"....; #I>8.I.h...D....t.......].a..".Dd...t.W.Jy-1..~...w.zR...=...A.Q<=============================================================..; Title .........: ComboBoxEx..; AutoIt Version : 3.3.14.5..; Lan...v.h...W...'E.M....[....\|M.)6.P'.D.Y~0JGB L..$Wg..W. .]....!with ComboBoxEx control management...; ComboBoxEx Controls are an extension of the combo box control that provi...1.)..E.Y..&P.......9..vR.>'..D.Q.Wd0,..c..j.gO...T......!item images easily accessible, the control provides image list support. By using this control, you..; can provi...e.-..F......(N.P....@.\|..r].y .Gi....+ex.D"N..-.3..[.n.O...Leraw item graphics...; ==========================================================================================================MA.,.u...D....t.......m.g.I~+...s..I.J

C:\Program Files (x86)\AutoIt3\Include\GuiDateTimePicker.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	15857
Entropy (8bit):	6.298329795753108
Encrypted:	false
SSDEEP:	384:WLg7+TlZ8ElFK9eX7hs+UNHGPV504mB8iWT/D:WllZNjqw5BtT
MD5:	F921AA3A28A12E6B1771B942A5B69F43
SHA1:	B778C0A57A6CD2399394C7C3C7C864A5DEB09C7F
SHA-256:	E88511D226685CB3ED33ADB8A0AEC30ADDDF67BAFB79D177C3EDD5620CA0BEE9
SHA-512:	3E7E6C706977CF62733DAA7CE50253974D11C9A6C025338D8FE77C722AC601907A9224C3A5C929D73C4800B7DCC9F63D11FB58B993D3E37207C04712B4BB9385
Malicious:	false
Preview:	.1.]0..c{s...E..s.[.t.7..&......Y...i8..."5.G.,....L@..5>^..r.ory.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"...&..5..j#x.....8.{.s....c.....Q..t.\...:3.CA=\|.e.ug..3.U..M!.ls.au3"....; #INDEX# ===========================================================================================================.e..a..;k!..B..-.F.r.l..(.JK....."c.......E.zY....o../.O..Z=.ion : 3.3.14.5..; Description ...: Functions that assist with date and time picker (DTP) control management...; ...Z=..&7r...!.Y.[.\|.0..B..ME..^..9jv....?".UA~..b.UB.!4_..Q;.itive interface through which to exchange date..; and time information with a user. For example, with a DTP co.,.Q0..i#<...h...F.r.7..t...E..D..vgv...v'.Bl...+.....`z....o. then retrieve his or her selection with ease...; Author(s) .....: Paul Campbell (PaulIA)..; =================================.e..a..;k!..u..D.......;.YX.....k;k.

C:\Program Files (x86)\AutoIt3\Include\GuiEdit.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	54349
Entropy (8bit):	6.3246109335626945
Encrypted:	false
SSDEEP:	768:yBhEDDDv7nW9aaFcL57HyFeXWlHUqJIjwDX2ApRTNoSMrhHNr9VSbq346e0Qfzmj:6hEPUsr8LNIMzGq1kFN6gXak
MD5:	8C72F4508DFCFC9A281647A9828BBEBC
SHA1:	031E21775236087FCF2AD5F0D4EF26E653557E05
SHA-256:	19E5698912374B7707307C36907347E5C541DCC5AE97CECE59CE1F1400CC90F4
SHA-512:	1061E6087C8E84D32D38AA4C6C7C95E3C9784BEE7F3818C673F6D0FD77A4C6A5A64E1D1A307C62D6B22DC7ECBABE7C14480F048EDC0E0712FB043C69D5C8FAB4
Malicious:	false
Preview:	...,.....zi.S"..U.IT..A.%+.l2. .^.....K6...A&i....v.b.......usBar.au3"..#include "Memory.au3"..#include "SendMessage.au3"..#include "ToolTipConstants.au3" ; for _GUICtrlEdit_ShowBalloonTip...E.......\|,..k.P~HY..O..\|..{.'.I......ilSL.+.h..G.f.b_u[....ude "WinAPIHObj.au3"..#include "WinAPISysInternals.au3"....; #INDEX# ===========================================================...r.N.D...$1.d....,..[..\.]r.%L.s....N....8.0._r:..T...}oBE.w..Title .........: Edit..; AutoIt Version : 3.3.14.5..; Language ......: English..; Description ...: Functions that assist with Ed..,.......tm.8H..Y.^.k..A.@o.8Q.n....S....DS-..&s....g./>_..]..rectangular control window typically used in a dialog box to permit the user to enter..; and edit text by typin..!.....`n.8]..1...[..\.]r.%L.s....N....8.0._r:..T...}oBE.@..=====================================================================================....; #VARIABLES# =========================...r.N.D...$1.d....,..[..\.]r.%L.s....N.

C:\Program Files (x86)\AutoIt3\Include\GuiHeader.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	44619
Entropy (8bit):	6.287935856263052
Encrypted:	false
SSDEEP:	768:5juLVqv2XLqF6yE/6chi1XmNenrDEVEnR9DhCXKOzMPxnBzF9dY7oxRaJh1W8:NE0XLcGR997lWU8
MD5:	B43B6E42E24FEC281E1A57236D4CCF58
SHA1:	43BABB396C0C35D5905298CA1478B5633766FF3F
SHA-256:	B2A6CFFC858D97D8A1E151A28C3187A44C09FD6E97CD3A7E7B09DE6DE62AD782
SHA-512:	3615BD054C2C59C8BABEE312C06E5BFFDB9126AF9EBF06951B9963BF4090A828FD43650357026037E0EA049B62205D1B829401E5E93CB3C3C23D321206203617
Malicious:	false
Preview:	.....E.}64.............&..S+>@.H._ ..DX..g....~\..L..}>..Qsy.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"..#i..}...].04....L.....D..q%..U&/A.+.f:.#yxU.[.\|.vXv^...]^.Ry..!#INDEX# =======================================================================================================================..A15.M.pwt...-..N.....t...j.P.d.Es...CBC.2.(..9.C..%g..7..]siption ...: Functions that assist with Header control management...; A header control is a window that is usual..1..H.964....a..N.....h.Y,zQ.s..<...EFN.`.&.$.c...\..1....uitle..; for each column, and it can be divided into parts...; Author(s) .....: Paul Campbell (PaulIA)..; ======.G,\...Bmdg...>...S.J..F;...wg..6..n..N..../.5.9.*.J...P.bN..<=========================================================....; #VARIABLES# =====================================================.G,\...Bmdg...>...S.J..F;...wg..6..n..N

C:\Program Files (x86)\AutoIt3\Include\GuiIPAddress.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13083
Entropy (8bit):	6.273108318235322
Encrypted:	false
SSDEEP:	192:14B2pAuYcVUj5/ZkUlvmHlr3luNgl/Pl1zw3ulffNnlFfxlg:yYpeyKJ6UlOHlrluNglHlRrlf1nlZxlg
MD5:	575F1CF0E7B0FDCD60F74A2D62C782EC
SHA1:	8E5720CD6BB4A325EB76A2BE34D7B1898A86753C
SHA-256:	E46EE2963BB7410F53C9F3065C479F8AB7348A5CEBDFFD7E58CD69E988880B40
SHA-512:	1AFBA925F14B9C8887633E2A0A73731E53E533908F3B2A7A7E78909DE5AAA7B22A56BB9883C2D1F83A470CA1DF7CA896F5B3F644216DA9312BBF89777481DE4E
Malicious:	false
Preview:	.C@.Ra.xCq6....8...B.xx..d....e...Kp.fG..C........R.,..I0.<.mory.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"...G.]x.y.>z...e.....x/..L..m......{r.......L!:.`.....Yt.QRWinAPISysInternals.au3"....; #INDEX# ===========================================================================================.....). S#e.......R..0!..{....!..TV..;.........pBY..N.3..&+.0.toIt Version : 3.3.14.5..; Language ......: English..; Description ...: Functions that assist with IPAddress control management.. ...a.u.lp.......U..ln.......!...^A.a........../%.W..}...-.LM============================================================================================================....; #VARIABLES# ==.....). S#e.......R..0!..{....<.......(........../%.W..}...-.LM=================================================..Global $__g_hIPLastWnd....; =================================================.....). S#e.......R..0!..{....<.......(

C:\Program Files (x86)\AutoIt3\Include\GuiImageList.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	31940
Entropy (8bit):	6.258468483588935
Encrypted:	false
SSDEEP:	768:kfC0IrAtlK3INENVcAdQBaMmJfb6LS5rrgBQu72:OgK8cBa1leBC
MD5:	271CCFD9AC6A4CB33986D15AF9F472A3
SHA1:	544BCB123D743C36565B5B6438E1D03784F29976
SHA-256:	4FBD72B38118CF7710CBD640BFE2BABC2C05DADDBE3A31FB32016B6E2572DBCF
SHA-512:	B75A867D839C1223CF62D0844F98011BE4B79F72530D47D0F463122FB142E9BD5EB1E183FAA5848AF8D63A83056C5641D881BE1E7FBEA44EA04A50E9BA8F56FA
Malicious:	false
Preview:	..yt..U7.$bJ.Z.#.........S-WFsm.....'......&{)d.d..v.=.e.<..+istConstants.au3"..#include "StructureConstants.au3"..#include "WinAPIConstants.au3"..#include "WinAPIConv.au3"..#include "WinAP\|7ee...3..h.%..7..........y,zyHi..Z..zT.)...g.V#...\|.Mde.2..Iau3"..#include "WinAPIRes.au3"....; #INDEX# ====================================================================================.O...o..w<..m..........-...<..Ty..i".W...*X.iH$..(.T@M.8...t..; AutoIt Version : 3.3.14.5..; Description ...: Functions that assist with ImageList control management...; t.7~..V7.#r[.9d.........,.Fg......:V.E...aVP&.o..h.1.I.>...f which can be referred to by its index. Image..; lists are used to efficiently manage large sets of icons or b\.zv..r..&!F.1pL.......q%^.mG..T..,V.L...m.F#k...2.=..J}.G in a single, wide bitmap in screen device format. An image list can also include a monochrome bitmap that..; .R77...r.%o[.9yZ.......tbOF!J.....$.

C:\Program Files (x86)\AutoIt3\Include\GuiListBox.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	44404
Entropy (8bit):	6.212966700441744
Encrypted:	false
SSDEEP:	768:N1A0A+tvmdet/XEvqPi3qSOh4MtSDhVtp3O+d5l3HLYnxq/Nszv3XFhkiVNDKA4S:Nz7vN/sjex
MD5:	CD11AA751FB7D3F35209CD2B62895BC6
SHA1:	ED68509BB851CFCA3BC1DF9E291D9802EADACEB2
SHA-256:	66E74CA5A6F397991BCEA912E28DF4889F1C49B8F363BD9DB889AFBA28214D01
SHA-512:	E769C698835852C2E7E4C510B7B64472CEAEF1F1CF135DC6BB8A7B2E1CEBA88E1A26AED3894F2BE3D2AC6E15E594A4FB5228F3C8D9CADD9DFB876C2E94A5A2BC
Malicious:	false
Preview:	..h..b.1.>...+?..."g...@8..,]W.E1qlw.c.pK.k.6?z.'..>..t.L8...onstants.au3"..#include "SendMessage.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"..#include "WinAPIRes.au3"..#inc...n..Q.......o[O../j..ou.S.5v.e3KM..>&X.[.(k).v.Bf.....q...==================================================================================================..; Title .........: ListBox.....~..O..../..H....o8...N/K.e>t.X"ecd.mH+V.H./vQ.,..(..2......iption ...: Functions that assist with ListBox control management...; Author(s) .....: Paul Campbell (PaulIA)..; ===============..6..;..c.`.......\|6..]'{.c#.A.x-?>.p[8E.[.(k).v.Bf.....q...================================================....; #VARIABLES# ==============================================================..6..;..c.`.......\|6..]'{.c#.A.x-?>.p[8E.[.(k).v.BV.T.]-.._g_hLBLastWnd....; =============================================================================================================..6..;..c.`.......L...#U..._v(ef0?>.p

C:\Program Files (x86)\AutoIt3\Include\GuiListView.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	226127
Entropy (8bit):	6.616494873479137
Encrypted:	false
SSDEEP:	3072:a7Aw6OT0/ni5zPIFOMvobimds/Ut9HMA8ALBq0i:rwfT0qLHbimSUt9HMtV
MD5:	1454617E0FC632C07ADBC21F592FBF34
SHA1:	79C26F93FCE1094BED93928E5216884F1B896C9F
SHA-256:	865D385D576C591C709E6EEE2126D77CF18F398CBE2955A04B697CD7111C7174
SHA-512:	454C9ACA6F7A8771AC6CE10E041FA87F3F3010E8A22D572C91EF1B66979286C97266CAFB6CCE037EA0C36767021D280BA5A3F89949794577323CC081E33E5177
Malicious:	false
Preview:	.."xZ.............Ha.....X....).....&dS.....@...z..........(An.#include "ListViewConstants.au3"..#include "Memory.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#includ.nNr..........`...........h.j.!...h...O..P.}..T...z......Z3*Gdi.au3"..#include "WinAPIMisc.au3"..#include "WinAPIRes.au3"....; #INDEX# =====================================================..q&...K.R.V...(..2...\.E..0.u..r...SM.\..^.M......Y#.....&^^==..; Title .........: ListView..; AutoIt Version : 3.3.14.5..; Language ......: English..; Description ...: Functions that assi..ll_..V......5.Na........l.-.!...!UP.A..C.P......D>.....h.5iew control is a window that displays a collection of items; each item consists of an icon and a label...; List..)l............z.Hk........a.?.<...................r......v.M For example, additional information about..; each item can be displayed in columns to the right of the icon an. zT..X.e.K..z..\|...O.V..-.)..o...[..

C:\Program Files (x86)\AutoIt3\Include\GuiMenu.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	62224
Entropy (8bit):	6.205803698944779
Encrypted:	false
SSDEEP:	768:ypujYxK32qF7xwU+hzgH4LPeaTpqFJNpn2NHanaO2:+ujYxMpca9al
MD5:	E932AB23577DF2FBAFED0029B94E9C23
SHA1:	6EE5D4BECE9D5D4B5B215F432B896B1389A11E81
SHA-256:	F21DFB6DC94DF948B8E3DCD9B0C47498291038614A8F97561109640A2ED0F063
SHA-512:	C47DC6EDDB1B5814CE33DADB52F294A6D6FFDADB64E77BA958929FFEE328775CF3B984D14965211B985F24C4F13782C5ECFFC958C9279AD25238778B01723DDF
Malicious:	false
Preview:	...{...s.&.....r..........u.pd.T8....j0.......4.&........U;l.q.reConstants.au3"..#include "WinAPIConv.au3"..#include "WinAPIMisc.au3"..#include "WinAPISysInternals.au3"....; #INDEX# =========...%...+.t..>.B,..._........#,c.k....#~....../Ju.KS....t$.8.==============================================..; Title .........: Menu..; AutoIt Version : 3.3.14.5..; Language ......: English...8...u. ...l._?...B.....W.m1S7....mS..Z..z7:-..V...N%9.d.agement...; A menu is a list of items that specify options or groups of options (a submenu) for an application...q...x.i...8._1...B......>1~V3...j&M.]..a7.h......N;9.d.ses the application to carry out a command...; Author(s) .....: Paul Campbell (PaulIA)..; ======================================...%...+.t..>.B,..._........#,c.k....#~....../Ju.KS....t$.8.=========================....; #CONSTANTS# =====================================================================================...%...+.t..>.B,..._........#.T\|:..>.

C:\Program Files (x86)\AutoIt3\Include\GuiMonthCal.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	45721
Entropy (8bit):	6.341924733767278
Encrypted:	false
SSDEEP:	768:qyoVbjeBrouqLRQiHUWwovKH0G9Ps22MPLzrE6bGvEKfjgEPFZZcAmvdR:qyyawrHSd9PxFPLzrxbGDgHR
MD5:	1F090A1379DBF989406842EDD6265678
SHA1:	3067EFB50D562FED0024B3F84E380F0DE0E5C2BB
SHA-256:	D68379A5FE9953EADB5254F09903C7FDA1409823F7C6B249C584EA8B79A0E1A5
SHA-512:	0FBEF2C59AFA4CC8779930631990768F75D5931FFF202EF9088663E5D47779E46D44D1C4826AF2F497E6BA9495DA3C0AAE43F94D3E2FD26076CAFCC22B8313FE
Malicious:	false
Preview:	L...... ...#.^K.T6.j..u......5PL.m@`2..j..s.e0...b4...g......ory.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"..T......)..`..(..E.I..c..^..{...WB.[Kka..m....Cz....n(...p.......; #INDEX# ===================================================================================================================R....e..,.so.p;.*.....f......UD.JN\|L..$..).Yw....x3..F9.....4.5..; Language ......: English..; Description ...: Functions that assist with MonthCalendar control management...; O....(..(.0 .;{.e..c._.....IM.CJ`5..e..<.um....g3..Fv.....nterface. This provides the user with a very..; intuitive and recognizable method of entering or selecti......1..B`.;$.=z.p..l..G..V...OH.K\.5..$..-.\|j....d4..]#..... with the means to obtain and set the date information in the control using existing data types...; Author(s) .....: P.......5..,.{..+y.E. ..Y..0...M..INh3.

C:\Program Files (x86)\AutoIt3\Include\GuiReBar.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	70114
Entropy (8bit):	6.284618502805753
Encrypted:	false
SSDEEP:	768:Zg2M0y93gvnGzJ5iYMIboyUMxT3dAgOCUKD45ueH/sWf6AqfUKQNsbPm/CqEaH7J:ZFw15i3mC6UK1brwDIuWPWKHO
MD5:	17940BAAA18CF61CD4E86D413CFC418A
SHA1:	A85F3EAE168AD4D385E5B2091B5E1A1FA97354D2
SHA-256:	D9179D3AC5742E16AA0334DBBF298B59D65C958CBC96C9BF2472FFF73600B418
SHA-512:	01FC89CE80350657CCBD9472B46BF42575BE031418E846954D6E398BFBC214D19ADB064A3E377675E62FBAFD251A2878F92737162F35ACF334D1DB0ACC2DEEC3
Malicious:	false
Preview:	........nt=G..Q......y......;...........yF..H....'~...[..2.'.au3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConstants.au3".t[....d:\|uqs.J....\|..LmV.'...^..Kd..J.`..!...(m..CI..~.^..; #INDEX# ====================================================================================================================.CE.t...uv;.63r4......=... .x.rR..T..<[..i/\..R...h=.SX%..\|.5nguage ......: English..; Description ...: Functions that assist with Rebar control management...; Rebar contro..X......!y1Ll\|5t.....o...(...>...L..<L..{6C......(,...A../.7hild windows,..; which are often other controls, to a rebar control band. Rebar controls contain one or more ba....s...!:~.8=\|:....=...%G......U...l..r'E.....)a...I..3.tof a gripper bar, a bitmap, a text label, and a child window...; However, bands cannot contain more than one ch.......v4S(#=.o.....4..oI[.i5......s

C:\Program Files (x86)\AutoIt3\Include\GuiRichEdit.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	209491
Entropy (8bit):	6.583972869596515
Encrypted:	false
SSDEEP:	3072:4IhehBQsmsAcj+GUeQ0Mly1BDP12wLNLyVTHiUdq:lhefhtjnlQ0MQBDd2kLyVeUdq
MD5:	106160B224C55793D2B3A5A9C804CF7F
SHA1:	8665DB16701C6123F101CF475B831095783A1800
SHA-256:	F774EC0A54E6DFCB940F1BE6C5124D3A008440BD4A22D9B1F8B5D3FD2E5606DB
SHA-512:	7C3226E94B556A585F9248BB6AF78B2C4AC7BF8FCDE1D1434933C640363BCF46253EC715AF66E6CF35A040FCF5FFD841F4831AAC450A7A36D48065EDCAE3D17D
Malicious:	false
Preview:	.+u.9M..{`....tD..Y7..7.).....k.%.g..6=...8.]y1.Uk..?..z.yo3.ts.au3"..#include "FileConstants.au3"..#include "RichEditConstants.au3"..#include "SendMessage.au3"..#include "StructureConstantFlz.f...uf.....,..e.......\...z..f....-m...Pq.i\|*.`.w.5..X..(.X.include "WinAPIHobj.au3"..#include "WinAPISysInternals.au3"....; #INDEX# =======================================================..&.h...k2...OCt...d....q.....&..y.>..~3...l..(y..v..f.....7&o...; Title .........: Rich Edit..; AutoIt Version : 3.3.14.5..; Language ......: English..; Description ...: Programmer-friendly g+x.u}.."/.....&..:b..7.$.B..;..j.-...o...G>.J9d.B#U.w..K.Ju6., KIP, c.haslam..; OLE stuff .....: example from http://www.powerbasic.com/support/pbforums/showpost.php?p=294112&postcount=7..;..&.h...k2...OCt...d....q.....&..y.>..~3...l..(y..v..f.....7&o.================================================================....; #VARIABLES# ==============================================..&.h...k2...OCt...d....q.....&..y.>..~3

C:\Program Files (x86)\AutoIt3\Include\GuiScrollBars.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25030
Entropy (8bit):	6.334041711127321
Encrypted:	false
SSDEEP:	768:wBh9Z94RnWo3n3zqAdJExESrMFe/2dOdQ:ozuntqmWZQ
MD5:	414E752E45BC9FDCE4A485C91E061778
SHA1:	1A0B20ACC4ADBFFF6EA307FB5B6DD8D53F67C532
SHA-256:	290A812A696E2B2212A296BCAC988CA685528B657C5D8D3FA3AE418C20CB6FAB
SHA-512:	037135207D4D58D129188D5E1A9904F75A06A0F88BDA49AFF738E27ACFB2E5018E002DDBD0F150B645863ADFB2DD85D1AF2E87F01A589D6EE13D28F8091E0192
Malicious:	false
Preview:	.t...s..Qq.Y.r<.e.J...jH..;..0Q]...8.N...P$qU.5.5..i...EU--.NtructureConstants.au3"....; #INDEX# ============================================================================================. ..I;..A#..r.E..{....3...et.e.TK....yQ.....ye..e.W..B..m:.hL.ioIt Version : 3.3.14.5..; Language ......: English..; Description ...: Functions that assist with ScrollBar management...; .=..T&..\>.....R.).H...\|.....6(N.....w.U...@w,\.`....t...^.)..rw button at each end and a scroll box (sometimes called a thumb)..; between the arrow buttons. A scroll bar rep.x...r...v.. ..C......iY.....25YK.@..w.....Ew0V.c.L..nT.@GX&i.j's client..; area, the scroll box represents the portion of the object that is visible in the client area. The .r...o..\q..;..<.}........H^.e\|...@.%.Q...K/.W.g._.. ...^T>h.=the user scrolls a data object to display a different portion of it. The system also adjusts..; the size of a s.o...&...9..<..^..F..}B.....e5I....4.

C:\Program Files (x86)\AutoIt3\Include\GuiSlider.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	27088
Entropy (8bit):	5.980153509948303
Encrypted:	false
SSDEEP:	768:7hBUOcgS14HJmRbEvpHP/NcsnrhOnbL6JzkeDHqkabpsn4MMy5SWQ:FOmSAf4yIN
MD5:	40CBF059B7C69560F571C943D3F1D007
SHA1:	6279F919721238452A066951AB14A3C3F0590F07
SHA-256:	F79E19F8B31EE3914CEA5F6655D168A85791F6959DBE847376AF97BCD42D2EC8
SHA-512:	7593F2D9A9757154DC713EFBA6C9A69770D5E33B5725B9130F2164E29878A4FA82130974FE0E466FCB4A4AB439367122AD2FFA103FF23F7C1442D61B3CDEEC30
Malicious:	false
Preview:	.2O..EL.:.....@p.dd"..}h1.!.QO4..gn!...S.d.0cK.dC..N.C.....&..stants.au3"..#include "StructureConstants.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"..#include "WinAPISysIntern.7R..E........4.HRb.$0,.OV..D.X)2{....].T..7..5.I.S.-.....X.U=============================================================================..; Title .........: Slider..; AutoIt Version : 3.3.j..Z=".7......#$o.771...SB..h.4f......zeK.&.Z.N.e.......Hthat assist with Slider Control "Trackbar" management...; Author(s) .....: Gary Frost (gafrost)..; =============================.f..R.......pG.07\|.$0,.OV..D.X)2{....].T..7..5.I.S.-.....X.U==================================....; #VARIABLES# ============================================================================.f..R...*....pG.07\|.$0,.OV..D.X)2{....'...rf..Wi....\.......b..; ============================================================================================================================.f..e=".7.......4.^)a.$0,.OV..D.X)2{...

C:\Program Files (x86)\AutoIt3\Include\GuiStatusBar.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	31661
Entropy (8bit):	6.383636533801762
Encrypted:	false
SSDEEP:	768:J+qCFfYHyHCI8kuB4xtKEwNJVL38IrRxo8+p4V9P+KqwMY1nAj:JpCFfWyHkhP9hdV62lS
MD5:	20DC3787BC1CDBF06C6DDF5A5714F5C8
SHA1:	1F2C044FC3FA2704A97A2DACDD378FAD549723F2
SHA-256:	583990202C8946172769CA1452D56A802CFE81494EBDED199000ECE272EA2D94
SHA-512:	901B37134FD5F80365F4A234BCBD3EDCBD835494D8882B4877CFF9FA0BFFC9D1D843F3097408994E2AA17BF619C09DBC8BB130787A265B6D72B764F6B22E267D
Malicious:	false
Preview:	.......\|.(>..*.....W.:.M..q..Jw.a.+.t..o..._i{.g..........8.3"..#include "StatusBarConstants.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"..#include "WinAPISysInternals.au3"..jn.b.'W......#....k.........8.rTc.k..;.Q..0#...C..aH.....+..====================================================================..; Title .........: StatusBar..; AutoIt Version : 3.3.14.5..\D.#..l. 5...0....8.E...1...A.<.,Y&W..h.B..7>..Z...3....b..ssist with StatusBar control management...; A status bar is a horizontal window at the bottom of a parent windo.G..b..p./p.....n].Z.".F..]..Al.?.?I[).&.L..->..^..\|U.......s kinds of status information. The status bar can be divided into parts to display more than one type..; of in....#..v.JZ.f..v^............ud.#I.Q;S..j.L.zlk..uW..gU.....+..=======================================================================================================================....; #VA..%...=:.zm....#....k.........8.rTc.k..

C:\Program Files (x86)\AutoIt3\Include\GuiTab.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	41781
Entropy (8bit):	6.35117181723044
Encrypted:	false
SSDEEP:	768:JLEzsjJ6LL0I5YWi9tTPErk+qjpGrNAnItETqiE7hkTdTN/jBuT3aLRE6I4t85Gy:Jgzsd6LLj5YWi9tTPEY1UGIteqimh+de
MD5:	47D762E07EE2C43EE4AFF039A494367F
SHA1:	9666C1675008CBC441657A7622C5F09C947C0E49
SHA-256:	99629EECEF842760AD3319D24C294F6489913A62FD69572566A3C99300A98F9B
SHA-512:	E642ED1573EB3A03B7CA0E429F686E451E5B6B4B7005A5453BD5BF5CA44A65F8BE00F1040E79C4F6FAE047EEA35D2ED98752D2B875A384458D89DC738EFDAE4F
Malicious:	false
Preview:	.SD...I.Q.Bq....E.3E.b..tt@..:.....y.....Bw....;&_c.\|..........3"..#include "TabConstants.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConv.au3"..#include "WinAPIHObj.au3"..#include "Win.jc...d...^\|...!.[i....@tA........1......$...G.&91;.%..T^.....L=========================================================================================..; Title .........: Tab_Control..; Aut.s^..._...B2[..!\|.k..;.@t...0..."......9.....hl...8.........n ...: Functions that assist with Tab control management...; A tab control is analogous to the dividers in a no._H.......Xz..n-K6X.g.jptB..;....n.....9..Z.hmba.8..I.....Q control, an application can define multiple pages for the same area of a window or dialog box. Each page.....I..\..2A../o.z..a.9x'...8.....i...H.m...Z.}$eh.w.......... a group of controls that the application displays when the user..; selects the corresponding tab...; Author(....G..F.\|s...L.C*I.b.j9..........m....

C:\Program Files (x86)\AutoIt3\Include\GuiToolTip.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	48851
Entropy (8bit):	6.408344202657753
Encrypted:	false
SSDEEP:	768:zthHTkZSUp7iY1nQ1r5PO81MnOn+f5x1TtBXTnb8ET:ztlq6P+VOOBbn
MD5:	996C9AF348A8C214C741834C991D9824
SHA1:	FE449A6F095E4ADBCFBD797192006F699D4249F4
SHA-256:	6935CAE75B400F16FE7768BBC5A36FD762EE1C3E1F4B9B286971599A22D4797D
SHA-512:	E4BB85BD2560B222A91F993BA11868FC59D3F34910029D9D7899D301F9AB01227C09DAE352F394C02DEAA4DEA0F87634E4142345B38FCCF4820C51F8B9B6C7BC
Malicious:	false
Preview:	.U.-..{W..h.5i~.4.Q.2..]-K\|[..:.*O.../........YH.J."...#....3"..#include "StructureConstants.au3"..#include "ToolTipConstants.au3"..#include "WinAPIConv.au3"..#include "WinAPISysInternals..I.l...m._.C.z<W.`T.Uz...B].,...f.$P...{.A.E[...7....zX..y...=========================================================================..; Title .........: ToolTip..; AutoIt Version : 3.3.14...D...%[..}.V...sG.Rg.....G~Z...3.mM../........^B.B....+....l management...; ToolTip controls are pop-up windows that display text. The text usually describes a tool, whi.T.'...?L......y.fI.Hg..._@.1...{.9...).P......k^.O.$... ....dow or control, or an application-defined rectangular area within a window's client..; area...; Author(s) ......../....7U..h.SD\.<.^!....D@.,...f.$P...{.A.E[...7....zX..y...===========================================================================================....; #VARIABLES# ===================...s...k.A.0..YI.`T.Uz...B].,...f.$P..

C:\Program Files (x86)\AutoIt3\Include\GuiToolbar.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	89730
Entropy (8bit):	6.185814103367309
Encrypted:	false
SSDEEP:	1536:OZHAt5P9cu3XW0btQVZpwgU0guiMOe3Ou8qjo:OY520u6RMx1c
MD5:	0E8BCE372A4F59618259AAB50A9B6F29
SHA1:	A5B28C6D503A847B5BF481B5D57ABF15F4D7C146
SHA-256:	2937C4E07EBE13FFC4FE30F8BD512E55A6953F23F9D7CF55D34154FFD29B1BC2
SHA-512:	4A305B39E327E163D0B49AC0B1523FEA698C9149AFFAEC4CDA9FDC80AD8ABA16FD079610FDB0DC08E6B05319F544779CE2AE9A654A22EDC381A999295F06D17E
Malicious:	false
Preview:	.}..%JX.I.H]..J...O........-IS....,.P3G........3.{b..T./..:.Cth3"..#include "StructureConstants.au3"..#include "ToolbarConstants.au3"..#include "UDFGlobalID.au3"..#include "WinAPIConstants.au.6.jVR...B[.....m0h.....X..j)6....5].[m....&...v..f..;FV..3..`ye "WinAPISysInternals.au3"....; #INDEX# ========================================================================================.).t..SY.....}..].P.......u...`..A.R(...I...=..'0.v'>..PsV5\utoIt Version : 3.3.14.5..; Language ......: English..; Description ...: Functions that assist with Toolbar control management.../.i..ND.....`...@.,....U..:.U.J..:G.J?.......d.\o..9(3..<..f=one or more buttons. Each button, when clicked by a user, sends a..; command message to the parent window. Ty.}..%SEBD.N[.."..X.O........h.H....8ZR.........w..s..9"(...YM\|s the..; application's menu, providing an additional and more direct way for the user to access an appli.u..&Q..i.....`...@.M.......hGS....=[\3G

C:\Program Files (x86)\AutoIt3\Include\GuiTreeView.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	125619
Entropy (8bit):	6.415772617166331
Encrypted:	false
SSDEEP:	1536:frTsU7xHHRUEnkpkrGdoghSLwAEqBfg1Buljf8qo3cfrtch93un:xnUGKhd+Dfg7uljf833uZcCn
MD5:	69EC7FAE1A7883B3DC8D9E8BBA2B0DB1
SHA1:	FC207AB5227B26CA5EB2C113E949A7BCDA0B2E52
SHA-256:	CACD1FCFB9EF1C8D178CC27F32D43EB1B6F44C231D66939B50B5E74A4E918902
SHA-512:	D6D56474BC9BBB694BE140EC09CCA9D1A145EA1D94E4DA3D4E2DB0C2694BB9921634D7994AF5C049DA39BB2C77DDF4A44465DC967C88EC5FE95C75F8C0DAC394
Malicious:	false
Preview:	z.f.!e.).H.55).(&..a.P.qm..$.~.+..!..Y.\|%/>...[..s...6.>n_...%u3"..#include "SendMessage.au3"..#include "StructureConstants.au3"..#include "TreeViewConstants.au3"..#include "UDFGlobalID.au3"T.+.#s.9.B.t.M.d\|.`.J.t}..n.4.(..1=....t>]L...[..jO...7/5`\...d"WinAPIRes.au3"..#include "WinAPISysInternals.au3"....; #INDEX# ================================================================d.5_p-.q...km......2...(5..^.*.{..yd.... m!!....W"A....L`#d...! .........: TreeView..; AutoIt Version : 3.3.14.5..; Language ......: English..; Description ...: Functions that assist with Tre<.a.:0.#.S.9<..DB.j.Y.a&..X.7.f..dy....=p<<.....z....cf8l^...( is a window that displays a hierarchical list of items, such as the headings in a document,..; the entries in 8.(.#t.4...$pP.@..c.O.tf....e.%..60.Y..sp}<...Y.JZ....}2>n....7ists of a label and an optional..; bitmapped image, and each item can have a list of subitems associated with i-.(B.i./.N.=9J..M..f.Y.9(....7.5..IS....

C:\Program Files (x86)\AutoIt3\Include\HeaderConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	7327
Entropy (8bit):	6.717429900783855
Encrypted:	false
SSDEEP:	192:AomZEKwwggKfPSaUo7ElAJgJiM08xcgCoOE9ZxY+nJK10:AlZ8wgHfPVR7EeJgJiM0q6taZC+K10
MD5:	447B12FF73A96F42F8821573CEFAA9EA
SHA1:	5E7A574A37CA8EF435F394EBF846FF0882D5F912
SHA-256:	64FD0B32A64209B32AFA9ACEEDF22BDE522B0F97ED2D38CFDB51080B2ED81DE1
SHA-512:	C09FE3F6D54B2B7E25717102EAE7FF5ECF08CD0B241BA20D06C39BD38E06E2FA047B5EA86BC08AC2F1D3D5723E32DC3FA4C2CAFFA3002F27EC858053293CD50D
Malicious:	false
Preview:	.V..,%w$.V. 43.J.+.@...wI.[..L.0.q...2.~\P.\|I=.!.Bb..~En..D.==================================================================================..; Title .........: Header_Constants..; AutoI..?.2#z....cb.&i.$.V..]T.....r.#.b..5.....(.h..'.;:B...'.......: Constants for Header functions...; Author(s) .....: Valik, Gary Frost..; ==================================================..T.}m.\|...~l.(z.-.^...,.F..L.0.q...2.~\P.\|I=.*!.Bb..~En..D.=============....; #CONSTANTS# =================================================================================================..T.}m.\|...~l.(z.-.i...PpY[...c.)..v..J..AP.q.0.',.Oo....<....Const $HDF_RIGHT = 0x00000001..Global Const $HDF_CENTER = 0x00000002..Global Const $HDF_JUSTIFYMASK = 0x00000003....Global Const..!...Q..t...q[..Y.+....!MK..@'.=.Fw..m./A../.t.3T.9.s...9...Y.x00002000..Global Const $HDF_STRING = 0x00004000..Global Const $HDF_OWNERDRAW = 0x00008000..Global Const $HDF_DISPLAYMASK = 0x00../.p`.K.3./>\t+.S.....Yq=..=ExL..~..2

C:\Program Files (x86)\AutoIt3\Include\IE.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	153859
Entropy (8bit):	6.76034110363429
Encrypted:	false
SSDEEP:	3072:M5mluq5VkVWJpHUOV1C6+kFOu1LpgYckwaKum3tIOI6SP3im9EjSnjQiAWYPTrLx:xPRX0OVykY/kQhCDPI
MD5:	D4EAB9CA24B8BBC6049907681B468D2C
SHA1:	A0A19E59C00679D01D6C97033FB69E0C518E8E20
SHA-256:	2140A4115547543C4EC1D479539E134C36A91E9739F76072B30DD50780DCF109
SHA-512:	0A8F4BD74E630A798032D44D37990DEA8DCB3E4703ED1DB332C9ED8CC226BE024D8E7C5CC9AB61FB6260DA057DED757E2B75A262827A80B729FAC772E76ABEF5
Malicious:	false
Preview:	....QU0..^.a.....;9....X.+d...c.g....j........OC(...B...onstants.au3"..#include "WinAPIError.au3"....; #INDEX# =========================================================================.....h....9....0oj....E1W,H.}..4^.y..yV........XC8Va.sQ...: Internet Explorer Automation UDF Library for AutoIt3..; AutoIt Version : 3.3.14.5..; Language ......: English..; Description ...e.6..\.g...-=1.....e....&x..j...0.#G...w.[..BH}. .}v...ng from and manipulating Internet Explorer...; Author(s) .....: DaleHohm, big_daddy, jpm..; Dll ...........: user32.dll, ole32.d.....HT4....h....-oj....E1W,H.}*..4^.y..yV...>.....`Kr.`9B..=================================================================================....#Region Header..#cs...Title: Internet Exp.....p ..].p....X........~.1..27.}...w..M-...m.U.....3a.(7r...escription: A collection of functions for creating, attaching to, reading from and manipulating Internet Explorer...Author: Da....I<_.._.m...7r=......bg.\|.%e.f..d

C:\Program Files (x86)\AutoIt3\Include\IPAddressConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1688
Entropy (8bit):	7.46406613604768
Encrypted:	false
SSDEEP:	48:kkD6OD65lPl7ZD6OD6eD6OD6BDOx9ZtC8nBD629dA:kHxltZ4F
MD5:	1532810052C8AB99B5045EE91B69CEC0
SHA1:	B39B10E4CF6DAEB70054E9CFE5CFEB27D340720F
SHA-256:	912E9D0BFF3A9FF344FA351C5BE2DF7525B3920E9808F98F2E82EEA15A63A1F6
SHA-512:	2CD2BA9DEC9A374619407BAE6CA03FEA296C5F2B17E6A53A3DE7DEDE54C8C997527002A0AFCE60C51D62878EFA43F387047325E6E9630B3B57F4E7E42B0D1F30
Malicious:	false
Preview:	Q..C.i.E.T....F.G 1b..vmi.$..o(.B..R....9.D.=..=..c..k...(\|..O.D..!.....O. q$p&,\|.....w.$..o(.B..R....9.D.=..=..c..k...(\|..O.D..!.....O. q$p&.K...ZA&.9..\|;.Q..U.w..`...s.C....."A/..a.]..0T.J.R.R...'lc(?p..>?q.U...'t....A....>.<.g..s..e.3AA.\|1.A..Y..2...T...\|"m>;w....ct..k...rs......P....B.A.h...-..x...;{.~...K.<.A.B.4.r?ma;?o....w.$..o(.B..R....9.D.=..=..c..k...(\|..O.D..!.....O. q$p&,\|.....w.$..o(.B..R....9.D.=..=..c..k...(\|..O.D..!.....O. q$p&,\|....8@.....Z.,..!.m..9.D.=..=..c..k...(\|..O.D..!.....O. q$p&,\|.....w.$..o(.B..R....9.D.=..=..c..k...(\|..O.D..!.....O. q$p&,\|.....w.$...y....O.Q..p.]._.A.......}l.A..\|-.4..O.r...B.)\|)@.V-.._...w..v\.2..#....@.+.S..=......sf.G..{1.7s.].t.l.-.N.Km01p...>?..v...rV....O.w..[.<.A.R...~..~.}.\..l6.<s._.n.o.<.B.T.NB.....z.0..>z....,.P..$.0.M.E.......a..5i.w-.)a.X.e.h.=.N.X.ON...`p..2..`<.u...._..G...t..I.......sl.Pa..Z.&..L.d.i.!.^.W.OP...~j..\...r$.L..e.R..e.Y.o..t.......wv.Z..{R.Y..C.i.z.6.X.J.T_...gj..F....5._..[.3

C:\Program Files (x86)\AutoIt3\Include\ImageListConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	2059
Entropy (8bit):	7.617977068402092
Encrypted:	false
SSDEEP:	48:TNlv7amYa3tlNlQ+NlRPTYfUq+6uS73WFD3KYhxtJlNl+w8RI3mwy:xcmY0fTT+jSD3bfJYI3m3
MD5:	EC425E7C1C4097319295BAEAB4E162D3
SHA1:	97FCDB66ACDC490F5C6BD0BC5028C6A678AAAB7D
SHA-256:	35805AB022C37DDB16EAA7B466B300F1910AFED041ADECD9BB30787F8E77A01A
SHA-512:	C299320BF97214F7CBA5DAAD6FC76398028DCA4CEF02A6A24C6812E3EDF9C1096A7E1312873A6B11682E455E5C1E4CF87C299B1538147EE5586B290DC918B171
Malicious:	false
Preview:	............8..}.~Z.^.8.DDA...?n..&.8.p)zl...C...`.E.<..j....!.Y...@......`..)r&.&.DDA...?n..&.8.p)zl...C...`.E.<..j....!.Y...@......P..4.r.w.YWR...,}..;`h.q.8..\|=WI.)...r...w.....h.............s..:z.. .5....Cgs..5.+.w4.?..J.P.f.<.r..@'....2.^.......A..;.E4.v.\|.5.....Ql0..tGv.@.\|q..W.WU...X./..m....<......w......`..)r&.&.DDA...?n..&.8.p)zl...C...`.E.<..j....!.Y...@......`..)r&.&.DDA...?n..&.8.p)zl...C...`.E.<..j....!.Y...@...?..~.xZ.O.U.Z\...?n..&.8.p)zl...C...`.E.<..j....!.Y...@......`..)r&.&.DDA...?n..&.8.p)zl...C...`.E.<..j....!.Y...@.....1W.[{-z.;......mN...ZzN.p4w)...N...l.r.m..H;....h.-...>......m..$.+.+.Itv..Fc?..tGv.m0....`1th...:.<.Qg....Z..n.......Z.O)..].X.X.56....2+..+.5.} J[..L.YK.....u.`......S..D..........e.=S#t.z.Y:....&...DjJ..Fvg...N@..m.H.0.#......<......Y...v.p... o&.+.IIL....:^..wFg.!4.>..W^.n...;.M...e....,.T...M...Z.]1.t{!h.;.05?..hG...;.%.5$wa...N......`..j8.....U..;.../.....Dm..$}+.+.s>...H"...h]

C:\Program Files (x86)\AutoIt3\Include\Inet.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	15435
Entropy (8bit):	6.665781778855703
Encrypted:	false
SSDEEP:	384:J8G90uumGhH0POUwWmlrPK/Nech66rqDDFzGb72wZZ:f9KmGhHy5mlrC/Nh66vb6w3
MD5:	2FDBA91BE3B2A9E463E085A88060BDA2
SHA1:	A07446E9ABDC2460A42EE60823CF51F50B47C263
SHA-256:	E5AB898BC734F3F2463D24C480863425BEC43E7EB20B7C97D096014C0E4DFE5A
SHA-512:	7F91EADB205929D36DAB48EF768184CB1F7217D2BB67DD17E88C020CA5132FB738D34CD89888CD364DCA7DC64483E9686B3ED5A90C3E370FD39D396D921C1D44
Malicious:	false
Preview:	...........8...;..0.Q.f..UL...B.........;.5.....pi.......AiG3"..#include "StringConstants.au3"..#include "WinAPIInternals.au3"....; #INDEX# ================================================..@....D._I`,.....c...?.J5.........B..b.(.r....;..#..TR5.=======..; Title .........: Edit Constants..; AutoIt Version : 3.3.14.5..; Language ......: English..; Description ...: Function...........)1..EW...I.p...&..b....V...q.;.o...A....d....j[, Jarvis Stubblefield, Wes Wolfe-Wolvereness, Wouter, Walkabout, Florian Fida, guinness..; Dll ...........: wininet.dll, ws2_32.......D._I`,.....c...?.J5.........B..b.(.r....;..#..TR5.======================================================================....; #CURRENT# ==========================================..@....D._I`,.....c...?.J5.........B..b.(.r....;..#..TR5.===========..; _GetIP..; _INetExplorerCapable..; _INetGetSource..; _INetMail..; _INetSmtpMail..; _TCPIpToName..; ===============..@....D._I`,.....c...?.J5.........

C:\Program Files (x86)\AutoIt3\Include\InetConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1610
Entropy (8bit):	7.4490271488340145
Encrypted:	false
SSDEEP:	24:wthZKRUBX1Bx2D7sG1bL1SN2B5HZDzWdQlcGWK9bVrXVzQN:wth0OYHrpTHNWdYcZK1QN
MD5:	2FB1824D646FD9684191A65AD45BE708
SHA1:	4974BC3D6433E111B4E47C6F47CACC07AE5FF77A
SHA-256:	7C5CFB4F04EB8649F1ED059C0ECD0061874309F9079161D3527BD2F352B07F20
SHA-512:	8ACDA75AFBAFEF296BC4AB6FD862C1482CC56F4C46D1A6C5350F8196A3240813246781A117CC9003DD007E38E7F92536517CE954762593729118CC97FE5543BA
Malicious:	false
Preview:	8...!f...\|.Q......e.y..d.J.y.&a..73}.#..#.).......\|_..h.d.x..&.K.p.[.....L...........y.J.y.&a..73}.#..#.).......\|_..h.d.x..&.K.p.[.....L........U.[!.Y.j.5r..$4`.p.A.{.I.Q...Lh....-.._.M...$\|...3..B......].P1...d.5r..$4`.p.w.\|.0....."..!.6.e..5.V."}..}.AQ........H.I.R ...d.u\|.~a..>..>.w.S.D..$...&.7.eb.~.V.8}..\|.A_.......D....d.Y.j.!\|..c`..m....4.......\|_..h.d.x..&.K.p.[.....L...........y.J.y.&a..73}.#..#.).......\|_..h.d.x..&.K.p.[.....L...........y.J.y.&a..73}.#..#...7.....,.....f..&.K.p.[.....L...........y.J.y.&a..73}.#..#.).......\|_..h.d.x..&.K.p.[.....L...........y.J.y.&a..73}.#..#.)......-..9...+X.;.?..G9..P.~2.......&.{.X&.....u/...G..J.Q.W.h.\|...a_..X...I.w.5.#`...Z.w%......x....v.}.(.y=..Ia..j..W.Q.e.c....0......e../.\|.!\|..3.].........t.u.v..#...H..3`....r.v.V.s...5B.......d.X.4..R5.....G.......J...X*...`.U..NA..R.Z.U.n.....K%.7.5..D.h.V..]#.W.e?......l.s.y..J.u..Q..fa".r..q.g...y....&.......y.Z.V.m#k....P..........r.c..8...T..CT..

C:\Program Files (x86)\AutoIt3\Include\ListBoxConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	5338
Entropy (8bit):	6.7287943615489265
Encrypted:	false
SSDEEP:	96:+ZUGTJt/Z0xvOXAqH4mhsIGRWPrel79phF9nJ:+ZBLZ0BZqHxGRIexRJ
MD5:	1048C15A123B98ACE6E9D8637CB132C2
SHA1:	A8616A498A53C43A33A2DBBA6CFA618A9FD42B1C
SHA-256:	BEF55B9AC640A7665023A1F2AF7FDDBD3AB2011DD0048F66E41D637E60971AB9
SHA-512:	58902D471C9CF2654FFE7D43EBEF1F87901BB2FB126C6BC40DCB6A14B26921DDB6BB4456C1F19A90C49306B0B46CCCDCB8B7FF13A3E76251D0E69B6B6D9DAE8A
Malicious:	false
Preview:	..lD.;.."^R...9./.H...LK.>....Zc.......Y..^....L..m^.AS..X..==================================================================================..; Title .........: ListBox_Constants..; Auto~."q#.,..#.......%.E..23....].;.......D.R.R_HH\|0.p'..t...... ...: <a href="../appendix/GUIStyles.htm#List">GUI control ListBox styles</a> and much more constants...; Author(s) .....: Valik..EF4...."CE.......P...4..#....Zc.......Y..^....L..m^.AS..X..====================================================================================....; #CONSTANTS# ==========================..?.{.bU.p.......).V...4..#....Zc.......Y..^....L..m^.AS..X..=========================..; Styles..Global Const $LBS_NOTIFY = 0x00000001 ; Notifies whenever the user clicks or double clicks V.qS4.1..Gw]...X.W.....-_.M..n3~......T..Q...s.H.#C..e....... the list box alphabetically..Global Const $LBS_NOREDRAW = 0x00000004 ; Specifies that the appearance is not updated when changeD.cU#.2..(=;...V.x.(..}3.R..q2......m

C:\Program Files (x86)\AutoIt3\Include\ListViewConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	23534
Entropy (8bit):	6.799082273889017
Encrypted:	false
SSDEEP:	384:E8nUaxG3ZmrKC9ton20xqdTR+XiBH55X1dOj9ylT1DdflGoYLhD2YGiuU57:qAy2XTRJrXOj9ylTpdflGNLhD2YGiuUV
MD5:	42B49A46D23CA8FC56423E1B5087C607
SHA1:	AC826D8226727CF028F4B21D3F3CB32FCA7B1BA3
SHA-256:	DC445A20C79D682B6BD57CBD6E17BDD1725497260224C8B3F356C420C1FE5B85
SHA-512:	0630D80328B511D41EB6D8DF45329E9F12D7CAA524207D6CFF0BE817F443A0F3EC801FC4372F9E19DA70CE1177E78D669DB06D5845C1156AE3290D79706A3F50
Malicious:	false
Preview:	np.m...RV.}2<.W.s.c....."...p.}R...@lK]1..<..x...]F.P.`.4U3.==================================================================================..; Title .........: ListView_Constants..; Aut"P.....D..}qc.n.J.r...h!....8.'....S.XZ,.f..6T.>[[u..>..y.g.n ...: <a href="../appendix/GUIStyles.htm#ListView">GUI control ListView styles</a> and much more constants...; Author(s) .....:mO.b....<.a(y./...o...Y:...p.}R...@lK]1..<..x...]F.P.`.4U3.==========================================================================================....; #CONSTANTS# ====================p$.3....F..ld.`.D.~...n<....p.}R...@lK]1..<..x...]F.P.`.4U3.===============================..; Group state - Vista..Global Const $LVGS_NORMAL = 0x00000000..Global Const $LVGS_COLLAPSED = 05).>....J...5.?....U..wM......+...]a.P<..1.w1.s..S..}..g.z.$LVGS_NOHEADER = 0x00000004..Global Const $LVGS_COLLAPSIBLE = 0x00000008..Global Const $LVGS_FOCUSED = 0x00000010..Global Const iU.I...r7.P...}.Y.;....c3...!."......"

C:\Program Files (x86)\AutoIt3\Include\Math.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	4961
Entropy (8bit):	7.581153906883698
Encrypted:	false
SSDEEP:	96:psszdr6dzdpzduhzdTzdzsdzddzdSdzd9lzdp8E4KJTT6zdz1HzdzEPzdFdzd4FS:bglHw5plslj4l3938E1al1TlYHlu5lhe
MD5:	7EE14CF0DF1E8FA31E356FD8E6E49BE3
SHA1:	34475264786777D510C43A8FB90146352FC710F4
SHA-256:	E78A0EE8382E570C82BEF910FEF98F2593C8D56A047299CA2BD92656A7B18D23
SHA-512:	89EA2D198C258A18BBFBB64226AF0513D4C77FE3BC2C0B151411B9A1547CE5177F0926B783C7BCE95C5401612284C6BDCB4D4150A7E4BBA2C6A36A0FFB3A60E5
Malicious:	false
Preview:	.....o..._..[.;.x1.JRf9.4Z.....#:X..D.....u..%.sx%..b.p.....).\..'....F.....fe....`.)E..L.yqi....T..{.:..D~8......n.....).\..'....F.....fe....`.)E..L.yqi....T..{.:..D~.-..N.?D...:.O.. ..D..S.E..:4.J_.>.x.6...7A^..._......Lu\..-%......b..../.....o....U.....{..NRz...ry.5.7/&B..C....h.'i.. qN.....;@....g.....s...]..V.\..2;.E.p<.w.....+"'....(..)[/\.Ym+......2M...S.....h....[.K._..(+...=P./X..L.yqi....T..{.:..D~8......n.....).\..'....F.....fe....`.)E..L.yqi....T..{.:..D~8......n.....).\..'....F.....fe....`.)uH.{.do.d..e.6...}N`.Zc8......n.....).\..'....F.....fe....`.)E..L.yqi....T..{.:..D~8......n.....).\..'....F.....fe....`.)E..L.IFo...K.....%BCF.tI>......n.....).\..'....F.....fe....`.)E..L.yqi....T..{.:..D~8......n.....).\..'....F.....fe....`.)E..L.yqi....T..{.:..D~8*.....pb...Z..A..'....F.....fe....`.)E..L.yqi....T..{.:..D~8......n.....).\..'....F.....fe....`.)E..L.yqi....T..{.:..D~8......Y.....s.....!..Q..4....26.#.3..u.+...Nwt....T

C:\Program Files (x86)\AutoIt3\Include\MathConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	1240
Entropy (8bit):	7.251278679247984
Encrypted:	false
SSDEEP:	24:SyAfAjhH8DqejmAfAgfAs/0r0YlEUAyWH2l7nP:84jhH8eO4g420rLlEbTHiP
MD5:	260B9B3A7731DFB9EADD0EFC2382EE3A
SHA1:	6534F39C5E7BD1AAFF38190B8EE961121DC00D40
SHA-256:	62B68BF9A031CB98CE52651EFC59259D36B7463EC5D926DD7F2BA240618AB501
SHA-512:	B1736F0C57ED05B28DEE591D958BF86B4E4F196209C645724C09ADD66AC557956189B461DD17A578962B0CC9FFF85D5CD6410D3FE3F2500932C2E7E3C6982F48
Malicious:	false
Preview:	.1.w.(+.......fEO9.... }.;.=....v.....\|....b.QL.H3....q.V...e.)E`r.....B..VrI$.f..X..&.=....v.....\|....b.QL.H3....q.V...e.)E`r.....B..VrI..`...Q.~......e...}.5.Hg.F,..y..x....A8."...=.g.2!....L.._aA..`...K.nZgC...e...u.&.~W.%U.LS...\|Z..]#.K.b.W.3<.R..._..K-.9.5...A...iH.H.....D.7.7W.Z6..7...`...]".K...0.r.3,.Z..Q..Po5l.3..MV.;.......,..U.2.....b.QL.H3....q.V...e.)E`r.....B..VrI$.f..X..&.=....v.....\|....b.QL.H3....q.V...e.)E`r.....B..VrI$.f..X..&.=....v.....\|..."R.W7R.:@`..z..H.e.)E`r.....B..VrI$.f..X..&.=....v.....\|....b.QL.H3....q.V...e.)E`r.....B..VrI$.f..X..&.=....v.....\|....b.Q.{.UQ~..\......1.<QPE._......!.m....1m.RhNi.m.....u.\|.&).o3..v..6a]...h......P1...z.._..YB~..`..!@.i^e........^.h..c.G=..72..}G..y..#.....Q=.o.....M..\xM,.h..W.... ....v.....\|....b.QL.H3....q.V...e.)E`r.....B..VrI$.f..X..&.=....v.....\|....b.QL.H3....q.V..============================....\,.Z.{Oh.2SF....(...@.s..#.QmeI....1....uy..WH?......C..*V.............

C:\Program Files (x86)\AutoIt3\Include\Memory.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	17664
Entropy (8bit):	6.268275658439905
Encrypted:	false
SSDEEP:	384:jd1/7LLZyzFZfgUrKz6hzCXK6zrXlp9yt1HnTriEBQmNd/q9OmWAG5:Tw3+zuCFRdWQmNdS4I0
MD5:	7D2AE203760F5C3E045037400CD9D6CF
SHA1:	1168D26D9F5655C95856D29CC0336C4D1D463D0A
SHA-256:	D056808B7E2D6196DC413A4CD2E531AB8B87D5A32ABDEBAA9B1C05D29946AFA3
SHA-512:	79F63956A835ADFD580BC905437C6ABD139C15D660C3D254428723447ABDAEF3E2F557DF19EAB1414AFAEACF58F45E711293E10905F3E8F161B1C783F3A04E3C
Malicious:	false
Preview:	..o.Fwu...*.......M,..8......$......D.5B..O...d...l.@.-h..59.ssConstants.au3"..#include "Security.au3"..#include "StructureConstants.au3"....; #INDEX# ======================================..<..?,..Ty.....,.....Na......v....K..f....Z .T-.V?...t0..Qgg.=================..; Title .........: Memory..; AutoIt Version : 3.3.14.5..; Description ...: Functions that assist with Memory ..o.Mg\|...j.....1..b..S\|......k.....U.4D..C.s..uGKk.\.,`....z,.rtual memory, provides a core set of services such as memory mapped files,..; copy-on-write memory, large m.n.S"b...+.......7....Y....8........4D.CF.=..s].".M.(j...aPa.Author(s) .....: Paul Campbell (PaulIA)..; =====================================================================================..<..?,..Ty.....,.....Na......v....K..f..:$j..I3{$].c..K..8...# =============================================================================================================..;..; Used by GU..T.l"...I0....u.G7..(.D....A.....v.>

C:\Program Files (x86)\AutoIt3\Include\MemoryConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	2747
Entropy (8bit):	7.75636970817957
Encrypted:	false
SSDEEP:	48:lv0TUvE6vuLMMWbFduz3egSN1mgsfpPsboHjf6gvOsvnrUcxaj:oFfL/zfbgs1s8HOeOSE
MD5:	65F6CEFE268BF1777F5BE5FD9CA6DC25
SHA1:	11E7B54E3405B111ABD6CEFB5CC8E4132C251777
SHA-256:	C423E9B7C40ECAD6C0F14574726DE355CFE915A17A5128958C923F8695BC0715
SHA-512:	055FA487FB00DAFFF4C8F8C702ECE5159DD8719F970A6679146C8EFBD519BD54F7A1DFB791A25F39AC8AFA477EDC7C5ECAE5CDF3040A3C6EFA005F3CFEC6E5E6
Malicious:	false
Preview:	:.^...#.+.8.gj.J.!V...8E......6.....1c,Dk..m.s+..u;R7.M....E$...._z.;Ck.?Z4z.'K...A=......6.....1c,Dk..m.s+..u;R7.M....E$...._z.;Ck.?Z4z.'{...(i......%.....,.t.9....!x...&r..-K..6.1m.f.....h^l.1I:i..X...G ......n....."d1<8..9.&...c.iU....-.X7....!(.u.7.v.)!.hV...r.....b.....7~P."..".=?..f(A0. ...b..t.R...g.V.#.K& J.!V...A=......6.....1c,Dk..m.s+..u;R7.M....E$...._z.;Ck.?Z4z.'K...A=......6.....1c,Dk..m.s+..u;R7.M....E$...._z.;Ck.?Z4z.'{...G ......E.....1c,Dk..m.s+..u;R7.M....E$...._z.;Ck.?Z4z.'K...A=......6.....1c,Dk..m.s+..u;R7.M....E$...._z.;Ck.?Z4z.'K...A.......+.....(.\<......R..x~_:.@....x.....4.&Z..GV..L3..9 .....9....m21:9..$.jQ....H Ih=....E9.H..Sw..9:.`.eg.u....XG......B.....1~!.f..`.DQ...)jOIH....f.5\.o..0..H7..?G9?.B...;l.....e......I.N4.....n+..x6W:z.. ..9._...g.A3..]#@..[$..0E......;.....n?}Y...#.n2....Y!Es/....<9...Sw.6s\.n.k&.:5.. ......C.....<&#If..Z."y...hE.dT.....5F.t....C^k.2.;w.*{....b...........S.

C:\Program Files (x86)\AutoIt3\Include\MenuConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	5208
Entropy (8bit):	7.8055231689919955
Encrypted:	false
SSDEEP:	96:2pxKra3aj/Iou6XMx5aNEYfZd0ldVCppwj9I7RvbL69KVPed:yMC6XMx5aNEYfQ4wjoTL6sPw
MD5:	4483CE0A481343842782588E62A42087
SHA1:	28E5E7760FC3B5A187148AED0A4FF0048467564F
SHA-256:	696A56C9897FCF3FB9E200EBCCBD31EFC6C89300F7E14981D12C9A2CDC5BDB71
SHA-512:	5558CC1AA2D1B514881E2C40D6C33C7E8EE9AB84E45C5E5D19A2A9C68F19FF11364B964100C0D6F47AE8892E06BBFF9D75DCBC16A6393A4787F7BFCE32364AB2
Malicious:	false
Preview:	.E...~#_V.......kK.>..i..w..S.DOj.PK.s.(7..C.8.]..._..1(...uP....OT6z.F.....2&.mV.J......w..S.DOj.PK.s.(7..C.8.]..._..1(...uP....OT6z.F.....2&.mf4L...E..j..@.W\y.CL..G{....Cv....o..,T.._....I...d).A....>/.ef4L..._..+.\N.W\y.CL..Lrf... ..@...O\|a..^hC...1.e4N.....`i...P...._..#.W..txl.,.O&Mg"..^.+.N...4.Je~..w)...j....k.U...../&.mV.J......w..S.DOj.PK.s.(7..C.8.]..._..1(...uP....OT6z.F.....2&.mV.J......w..S.DOj.PK.s.(7..C.8.]..._..1(...uP....OT6z.F........ZP.T..b....jM.DOj.PK.s.(7..C.8.]..._..1(...uP....OT6z.F.....2&.mV.J......w..S.DOj.PK.s.(7..C.8.]..._..1(...uP....OT6z.F.....2&.mV3}..S..j.V...Rs.+)n.j\F..;.8.P...h.Jcw.......X.V$M..5.../&.`..z...^..&.z....w. 0d.lVB..5hA.]..R.,Ky..Q$M..B..I/.\|$...H;.p[FG..]..+..-...#.I;}.eGK..:.8.P...R..<%..:....M.R*d)I......KR..)r2.....z..^.IBe.g1W!@tf..Cv.@...=.oXX...uM....BY;w.O....mz.p(Q........q+.27..PV.6.%:..N.=.j...J,V..C<M..j."&[.j[....?+.`[.G..]..+..-...#.I;}.oPD..?.G.%..._..t%...x].!.5.d%[......{;..-a:..s.....S.I.g.]F.~

C:\Program Files (x86)\AutoIt3\Include\Misc.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	32280
Entropy (8bit):	6.596791172605695
Encrypted:	false
SSDEEP:	768:COwRqoIyXsPre0jPWHI2JZT13pOTyDf1b4aQVu1:COwQHyXyPWo2JZRZOTyj94aQVu1
MD5:	F3541EFA50D8C679D41D846562818C8B
SHA1:	D16D02E40D04BC2D8056B9A7CE75AF72EFB8EDA5
SHA-256:	00A4AC60D56C669ED3292BE44BFDFB625D2E092B4DC1ADE19F38369C97B02A63
SHA-512:	94B8515775C874A2D872AB37DDDEC0E273452AB06854D18B90AB5F91DF8ED3DB5277B2366D84AF3DD872A847B4F10AD5845C55456090860DC7DBB7ECE0CF7E66
Malicious:	false
Preview:	..M..8!..qSO.,.:~s.G.......Y@....\|..:..v...X....+....)QM.LreConstants.au3"..#include "WinAPIError.au3"....; #INDEX# ======================================================================...Rpx..#......Im.........t..P...G. ..tl.>...o.........*.u........: Misc..; AutoIt Version : 3.3.14.5..; Language ......: English..; Description ...: Functions that assist with Common Dialog....Tm..vR^.R..Z~......Pip\...Z.q.. 0.#...3.......c..EB..(Klaatu) Thompson, Valik, ezzetabi, Jon, Paul Campbell (PaulIA)..; =============================================================...Rpx..#......Im.........t..P...G. ..tl.>...o.....r..r.f....==....; #CONSTANTS# ============================================================================================================...Rpx..YQC.@..7?.Z......`.um".;.I.....M.........7....QcB.[al Const $__MISCCONSTANT_CC_FULLOPEN = 0x0002..Global Const $__MISCCONSTANT_CC_RGBINIT = 0x0001..; =============================...Rpx..#......Im.........t..P...G. ..t

C:\Program Files (x86)\AutoIt3\Include\MsgBoxConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	4434
Entropy (8bit):	7.813449692689937
Encrypted:	false
SSDEEP:	96:HnyyNgEg0IdgYLpVRfaDoPrbmz4ss9VaP1sbw0JV:HdIjlVRrP+bsVaP1spf
MD5:	025C5992A6A02EAF7DA57F6D8798FEFE
SHA1:	BC2DEF2CB0CBE365A26C00351F008DB9BB5B6356
SHA-256:	7F706AA11518CC6B09E0F20AA1BD3C26BD114258D8142B5ABF6FB151B3FDDB99
SHA-512:	4A11F5B08BF86806965DAF11276E13EF6A3160380886CC7665A922D95EC2472026C54DC87B9980803D02C34B5AF40120D9E48C40BC83B1DF8387EBDB7BC0E5B7
Malicious:	false
Preview:	K;..?.L.t...%D..s(.a........A.A..B.8R..l.-P..a=..PM.....\|.CUo.n....&....t..n6...aj.....A.A..B.8R..l.-P..a=..PM.....\|.CUo.n....&....t..^....5#........R.R.._.v...).S.E.(a...}....A5.7.r..!..F.;....g..}>.%.\|.....A..R.R..Q.%*..=.c.&.g .......]..^F\|..s.G.o.....=..1n.F.?;....O....\....L..b.c.Y.,t......]/.^.'..'.G.V....Wg..h+.Z.48........R.F....k...".0.[.Q..PM.....\|.CUo.n....&....t..n6...aj.....A.A..B.8R..l.-P..a=..PM.....\|.CUo.n....&....t..n6...aj.....A.A..B.8R..l.-P..a=..g}....w..-<........&....t..n6...aj.....A.A..B.8R..l.-P..a=..PM.....\|.CUo.n....&....t..n6...aj.....A.A..B.8R..l.-P..a=..PM.....a...!..6..F.;....[(. .....9....C.........q...q.y.[.=y..M...Qa...!..6..F.....M(...d.\.\|s.......L.G....%...9.r._.3n.";...[#..H... ....Y....n...+...\|l...V.........k.....0.E.\|C......X....r..=....V....`..._.v..........G.(....%...9.r._.3n..M1....a... ..s.M.R....JD..?d.N.\|........#.9..0.D!....-M..g ......G)...&..=....~...@e..=o.l.24....J....\....

C:\Program Files (x86)\AutoIt3\Include\NTSTATUSConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	240988
Entropy (8bit):	6.717991314195826
Encrypted:	false
SSDEEP:	3072:gGkuAinBVecezUGOKUrP7WNU0W2jwS3KcTABtGU4:gBRcsU+mjW+ijwkTJ
MD5:	F400F900E4D2E5F7A97A9DF3391E8CFE
SHA1:	3279A3D80B8B62AD58A41F87126A477A356A0EA2
SHA-256:	6003370803F60AF4D892FD38CC0608E4EC4A9D9A725A3FD72DC423D4A5DBFE09
SHA-512:	BDF9C04CA4271DCA4B083DA53D657A23C3711DC1CCBA14D6845D77DFA5FDE5677263AA00A83CFC5856545EADE3B24C8FDE2C4348D26131AE03BA7F1CA4C4800C
Malicious:	false
Preview:	#..=i8.....Xe.9S...PrE.~..q.m...X.....V..._...P{....~Hn.N..t..M==================================================================================..; Title .........: NTSTATUS UDF Library for A..1L9....zu.\...`.Ix.T..k.c...T.....P.._....R./....m[i.=l.,...r codes (NTSTATUS) to be used with WinAPI* UDF library..; Author(s) .....: Yashied..; ===========================================..c8p....=..c...N.6....l.m...X.....V..._...P{....~Hn.N..t..M=====================....; #CONSTANTS# ==========================================================================================..c8p....=..c...N.6....\4....@.......1..w>...\|..&..N..1..@00000 ; The operation completed successfully...Global Const $STATUS_WAIT_0 = 0x00000000 ; The caller specified WaitAny for WaitTy..~d#......o..*...Rx.Z.9["...I.......N....@.#....1.2.SP.:...en set to the signaled state...Global Const $STATUS_WAIT_1 = 0x00000001 ; The caller specified WaitAny for WaitType and one of th..:l>....^r.\<.U.H+.U..9[p...O....

C:\Program Files (x86)\AutoIt3\Include\NamedPipes.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	14339
Entropy (8bit):	6.448140494799627
Encrypted:	false
SSDEEP:	384:mKmzKo4oyUS0UlZIDGcZDrSTLbFcYXrkV/9O:UMlZChYcO
MD5:	FDEB37392811E45B19E57470B7B32080
SHA1:	F2F7F960A5CF0D55A2C7A792F0B6880035F7844C
SHA-256:	2CAFEA40521D4DD5426D5ED226DE8EE8B278C373F9E4EBA9D5887A501BA21DFD
SHA-512:	EB39092CB170237E801FB7A5405D4193BF168527669DF25FFBC97FF07CD7D44BDC9DD5EE42FEBC319247C3CE92EB35F775F3F82184F13C4769416D9085D8E03C
Malicious:	false
Preview:	J....I...v.=..N.t...rcw.#F.#.......DyJ.:.9...GS.1.../kZx...kk..=======================================================================================================================..; TitleI..X.....7.~".4g..._cg.J..........=6..}.fH..+,.3.B%.<3iz.....: English..; Description ...: Functions that assist with Named Pipes...; A named pipe is a named, one-way or d.........\|.8..da....wur.j..w.......'bL.n.>...UC^e..D>.{9'1.\..more pipe..; clients. All instances of a named pipe share the same pipe name, but each instance has its own .....N...x.:..."^..>63.#D.w...Q...czA.b.6...VTCe..Vp.{%,$OA.e conduit for client server communication. The use of instances enables..; multiple pipe clients to useI....O...9.?.. ".....m.~.o..9.......'6e.7.'...CU_3...1.83:'.].ed pipes, subject..; to security checks, making named pipes an easy form of communication between related or .....]...9....'g.......(.#D.w...Q..'6..

C:\Program Files (x86)\AutoIt3\Include\NetShare.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	46121
Entropy (8bit):	6.559979685804381
Encrypted:	false
SSDEEP:	768:iFBjFT4E1JrFs6x69g0s2yAPHR0xGkg5SEIohkn8k:ejFEE1JrFs689gD3APHqwxT8J
MD5:	E09A8841C06514B06A343C0357184106
SHA1:	C2747D2E57EAD8F56299F1C0B701B36937651FFB
SHA-256:	E395C4B79DC47D84B4B9013E284870EA59292F10A9F0AFE083A6C8C41BA77790
SHA-512:	1D86345BEABD725E230F2C352E45AA7B3606D2295EFB388F5CE62CB7C1B22E8F8A9D810CA1740AC496812230EF941D6DB748E012F14D6124CF955F62E348026B
Malicious:	false
Preview:	XND..L4.H..}...dN.nD......._..y....s...1..k..7.......^[..0..nAPIConv.au3"....; #INDEX# =====================================================================================================F...P.m.X..#H$.Ty.. .....,...4G..K.... .....l.....s[:..f..ersion : 3.3.14.5..; Language ......: English..; Description ...: Functions that assist with Network Share...; /OO..\$....>.q..!.a_......,...n...EC... ...6..v........]&..w..resource is a local resource on a server (for..; example, a disk directory, print device, or named pipe) that .FD..\p....m.\|.I&.'_....M.h...j....D...6....e..a.........n..2.. network...; Author(s) .....: Paul Campbell (PaulIA)..; ===================================================================F...P.m.X..#H$.Ty.:....P..1...'T..X....x...x..9.........s.....; #CONSTANTS# ==================================================================================================================F ..V2....q.j.I`.Ss...$.X..:T......

C:\Program Files (x86)\AutoIt3\Include\PowerPoint.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	58031
Entropy (8bit):	6.499992988453552
Encrypted:	false
SSDEEP:	768:oZsZQ4cH6YnwKMK9lcJpfEoFuawr1Q1G4fRBxHj9FY43ZO+02:WSX/RpXwp6G4fVBJLP
MD5:	6699E3BD26F711648A4F15B1FD66B93D
SHA1:	D360DD15CFD9D9B8FD7DE36DE763BE5AC8375B3E
SHA-256:	35BD6DB61A8880E4706FB979AD09CBCE71DC42B000FFFA67D2F9354E1869D3DB
SHA-512:	B408C3E064365329CDC4CA2DF3A84549B367C4E99ED98CF2C982EF536A1DC7B3D15B15A9057F7EA258A815D9B2A5D1BA7FAB3415DE38707F3AEC1ACBECF2D655
Malicious:	false
Preview:	.,....-f.5.]-_...J..~I.I+.n........&.A..o.V../W.....*.^.L=_tintConstants.au3>....; #INDEX# =================================================================================================.x.]C.t>.g..uo.._.N.6....:..s........\|.....8.....R....Os.a.@!{;Function Library..; AutoIt Version : 3.3.12.0..; UDF Version ...: Alpha 5..; Language ......: English..; Description ...: A coll.&....il.z.K&1..J..mB...y<.t.........?..I..=.(..&.....We.W...`lerPoint files..; Author(s) .....: water..; Modified.......: 20170606 (YYYMMDD)..; Remarks .......: Based on the UDF written by t.$..^.:f.z.W&9..o.H.GD..4qH).......&..S..~.+.. A....Ku.X.]altm/forum/topic/50254-powerpoint-wrapper..; Contributors ..:..; ==================================================================.x.]C.t>.g..uo.._.N.6....'b[:.........o.....l.a..\|......+..K.B...; #VARIABLES# =================================================================================================================.x.j9.&a.6.....2p,.nO..'.V'.......7.

C:\Program Files (x86)\AutoIt3\Include\PowerPointConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	7475
Entropy (8bit):	6.638945299853551
Encrypted:	false
SSDEEP:	192:+fEV3U2QyDwR5a9eIFddlZzDtLcxapPpXOVWb9jA9:+fEVPF40Nz9xpMYA9
MD5:	520BA436BE0866699F4C55A88C8CC923
SHA1:	C63309203FAC1451243E28B87F844D3F48C93737
SHA-256:	C4A8EE8483BA558EB701372A94C6A3FA50F06D59066E73C60D553E6B4A82F157
SHA-512:	453DA6E25E59E9DD4994AB9E2766C23E8EAF4F964223125FB67E6BF64C4C04AF371A28FD8440EDA3E47184C544E5F6B650F5B18BE3E9370387894A688AE44864
Malicious:	false
Preview:	.=TA..P..;~..4Y...g.....d....$.Q.~k=...3Y..^.....CuR..B..6...==================================================================================..; Title .........: PowerPointConstants..; Au.;sVA.Q..=..C.s...ut..O.\|...~..O&v.... J....^.. tsO.....b...on ...: Constants to be included in an AutoIt script when using the PowerPoint UDF...; Author(s) .....: water..; Resources ......tjM..F..=~.C.c..q*3..0.3....#..\7&s...c......E..B.<A....e./library/ff744042%28v=office.14%29.aspx..; =====================================================================================.i..\...i-.^.n...y{....z....$.Q.~k=...3Y...X....c-....,..6...===============================================================================================================..; PpFixedFormat.-JGA.Z..1b..P<..g4#..$.g....m..Mc9f...v......V..K.$......s...t...; See: https://msdn.microsoft.com/en-us/library/ff746754%28v=office.14%29.aspx..Global Const $ppFixedFormatTypePDF = 2 ; PDF.2UP..@..\|..X?..Z72..2......_..E""TE..

C:\Program Files (x86)\AutoIt3\Include\Process.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	4135
Entropy (8bit):	7.664947986064948
Encrypted:	false
SSDEEP:	96:v/Be3BuBvBPBFBTz6BoQEECBJBzrMXbKDGGyKBqBRdqpy:v+UzvMsGHdqpy
MD5:	78AB65F36E907217273D5F72D941C739
SHA1:	C827CFCA80E96FF64FFC66E8298E43CC94DEE333
SHA-256:	ED3011A2EB826F0D7C8B3292375AD19B9A5F9873D01CE358B5DC699DD181BB5A
SHA-512:	8D16DB0E19DBB95D481078B5ADD7167FB98CF148415123A1B9ACD4FFF1FFF9119239382BF181F4E8A4860E1C523001468AF7F01501AF3CD8A3FD78C3EE9261EB
Malicious:	false
Preview:	.d.Z&...c.....bx....p+%......q.._.........x......>......\.>..0..wT..s.XJ..UH...Q.zm...../...!..R.....C0.....8...e..B.>..0..wT..s.XJ..UH...Q.zm...../...!..R.....C0.....8=".x....#..#..dG..t.5......&.W3.%......`..r..O...P8.....kW].?...Q.-..7.\|$...=.h}..,..H..c39.....2...........-.W..%GA.0....f..-.X$...#.....bN.j..{(".....<...Y........x.A...dD\.=.....h..!.s/...7.)...........;.....2...2..A....h.J...+TD.U..B.>..0..wT..s.XJ..UH...Q.zm...../...!..R.....C0.....8...e..B.>..0..wT..s.XJ..UH...Q.zm...../...!..R.....C0.....8...e..u......l.;....EJ..UH...Q.zm...../...!..R.....C0.....8...e..B.>..0..wT..s.XJ..UH...Q.zm...../...!..R.....C0.....8...e..B.>......9..-......;.F.a.\|p......a.L.......E-.v..V=".x..B.>..0..wT..s.XJ..UH...Q.zm...../...!..R.....C0.....8...e..B.>..0..wT..s.XJ..UH...Q.zm...../...!..R.....C0.....8...U..D. ..C.m.&.n.XJ..UH...Q.zm...../...!..R.....C0.....8...e..B.>..0..wT..s.XJ..UH...Q.zm...../...!..R.

C:\Program Files (x86)\AutoIt3\Include\ProcessConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1783
Entropy (8bit):	7.524562665040159
Encrypted:	false
SSDEEP:	24:FFOlDUlfhn4aIR5DUlDUClDUIdHCZUmqhsZhLeoUXCQDUUmGJM9EC:DP4aIRaHi4hsZCyG9JPC
MD5:	3985625F63F44530E1BF29DA53E4B193
SHA1:	D07E655E0A5CBDB48C48D77C52840BFE3CA9458F
SHA-256:	98030A2A2789E6515748A2E991D49428B680D56B419FE32506F62DDE50EE258B
SHA-512:	359D97A510466F7AD7CB9E087158A2B42436F51E9AFF76C5763E646376C6C52F770D7BEE47F59FF43EDE443521EB464D7312618F5A51CBB51CB8BF6A925FC546
Malicious:	false
Preview:	Qe..d. .:.;j..QG.d...Z)R\.[.j].^.W...v.-.......d.=.7.L....Fn..O1..5.y..h4..:ap.y..#Q7B.[.j].^.W...v.-.......d.=.7.L....Fn..O1..5.y..h4..:ap.I..J.~..F.yN.M.D...k.b......7.t.d......:&U.;x..m.7.x.u3..)oc.p...W3..D"....D...e........T.;.N....Q..:N.R"..2...y.!h..t\|9.d...w.i...F3@......>.......+.p........:O.R\.k.7.7. g..n3#.j..>-....Q...C.D...q.F.....+. .x.....U},.I,..5.y..h4..:ap.y..#Q7B.[.j].^.W...v.-.......d.=.7.L....Fn..O1..5.y..h4..:ap.y..#Q7B.[.j].^.W...v.-.......d.=.7.L....Fn..O.....d.T..Z..I...d..#Q7B.[.j].^.W...v.-.......d.=.7.L....Fn..O1..5.y..h4..:ap.y..#Q7B.[.j].^.W...v.-.......d.=.7.L....Fn..O1..5.I.P.:k..'.".7..N>E<.5p.4.1.#....-......i.1......Y.[.N..x..X...R..V..B......[-N_.F./P.S.Z...F.W......7.t...#..}.(.r.&S.[...Y..)..7$}.t...X.u..L5..C.....k.@........O.O.0..w.[n...<..8.t./._N..e=!....jL./.)`.3.<.'....0.......i.1...6..Z..sb.....,...T..Z..J......#L:..V.gP.Q.g...$.q.......}.R.I."..\|.+.i.<H.(.d.o.e9..7h}.N..\|.f_..M$..G.8....

C:\Program Files (x86)\AutoIt3\Include\ProgressConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	2381
Entropy (8bit):	7.69809566928601
Encrypted:	false
SSDEEP:	48:w3td5qKcJZ+tdMstdthf6884nP04x9uEanvjSpWkurChPc723AdtIle:WjqKc0HPhnncy9ckWkuqUy3APIle
MD5:	1912BCB54080A281733BAC22819DFBDE
SHA1:	D6EE1CA6E29B5D8BC31AD201F42B200BDCE64661
SHA-256:	87DB817558061F4F18B2624681136B44BD119C274ED7E38B7B43CD8922B61F1E
SHA-512:	B64C14B10978FC38359719C24B1D5C1BB45570B3781617CE9310502E0AF9BC5A652E39506A9511CAF788A621914F549119B7C6D6BEF2692940B2FC970E4062AA
Malicious:	false
Preview:	ft.....k..'!.....?P....).2.S.z9ax..f.....&r. -..X}>....v.F(C.xx T].3.Ht.H..."Nm..wL./.S.z9ax..f.....&r. -..X}>....v.F(C.xx T].3.Ht.H....yk..#..w.@.irk..u..g..\|=.nc....p...F-@5?.1T.@...}..'bO......G~..@J.^...2e; ..u.....;..z\|...M....(U.e..+=GN.2.U!0......0. ..$..j.)..W(<NH(..C..K=.zb...b=....$I.g..e.o.....}..=;....!S1..j..q.N.(v9eAB5..V..ha..+...4k....k.U;P..eK.......;;U.....3S~..G{.2.S.z9ax..f.....&r. -..X}>....v.F(C.xx T].3.Ht.H..."Nm..wL./.S.z9ax..f.....&r. -..X}>....v.F(C.xx T].3.Ht.H..."Nm..wL...c.\|$..mc...y.;r. -..X}>....v.F(C.xx T].3.Ht.H..."Nm..wL./.S.z9ax..f.....&r. -..X}>....v.F(C.xx T].3.Ht.H..."Nm..wL./.S.z9aH(.{..N..hB.Z\|...,#....k.+W-...O85..3.E1rE...'Sk.."..b...5a/6.O:.Z..~<.qy..E!#......Bv.9.'\|.@...}.Um.7.....P'...j@.....%e0eaB5.....Y..N]..1.Q......F5N.tu=R@...z.xC......\.>..jU.P.1..V..al.......B.&0...4q....-F.y..61d.....I..+#......kSt.....A.*..E..vr...p..H.. 0..oM....8F.p..O.q....M..:6U.....P4....3.@.!..P..vr...b

C:\Program Files (x86)\AutoIt3\Include\RebarConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	6733
Entropy (8bit):	6.752815555123502
Encrypted:	false
SSDEEP:	96:plFk/Vj1HD+ZzU8dYeAX0fr1DTRRA1vTqxyom6iQcum81M:HFk/VjN+Z5YemgJnRRAQgom6iQcxwM
MD5:	89519C322A99198C14A57897346748E3
SHA1:	9F80E89E4DF2DBDC6F14409B0CFD597FEA78F57E
SHA-256:	5B712C98904C889879512870FBA6ADDE71D3E4905C5F28A0D1EC272BE2CE051D
SHA-512:	EFC248FF1B4D1EA0EFEEEC2C90B7B5CB60FC4B5C206159C780641351B00427D11EE4B6B3AFE7ACD900D36A726AD25EC5DBC0540E86998E0C153FF2088004CD66
Malicious:	false
Preview:	.3`..ri.....0q..Ir.?.......o..u.8....V\|P./...Qn".$L-svU.K..$.==================================================================================..; Title .........: Rebar_Constants..; AutoIt..k..nb....\{O...\\^Ji..P..K.7.f.+...../..{...fh?q\|.s<"...U.9...: Constants for Rebar functions...; Author(s) .....: Valik, Gary Frost, .....; ===============================================.g3.N:0@...RhA...TliLt......o..u.8....V\|P./...Qn".$L-svU.K..$.================....; #CONSTANTS# ==============================================================================================.g3.N:0@...RhA...Tli\|C.s..Y.5..E.B.A.O.a..\|...H.@g\3Q..'.%n.W._WM_USER = 0X400..Global Const $RB_BEGINDRAG = ($__REBARCONSTANT_WM_USER + 24)..Global Const $RB_DELETEBAND = ($__REBARCONSTANT_..Q. B_]...FXv.....=t2&..J.x......H.x..VaE.M.....MvV?C..&.)m.F.SER + 26)..Global Const $RB_ENDDRAG = ($__REBARCONSTANT_WM_USER + 25)..Global Const $RB_GETBANDBORDERS = ($__REBARCONSTANT_WM_US....S49T5...:.....?'.i..\|..o......J.`..

C:\Program Files (x86)\AutoIt3\Include\RichEditConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	14689
Entropy (8bit):	6.817873657083667
Encrypted:	false
SSDEEP:	384:dU+OQHy8m3tGPDpr2+91KQYsimTO0g4fnSjtDvvDmftxmbw1uriuXAeaSQjEJ6E5:9dKfHQEk73+mUh5Gy
MD5:	CAC94EF74A5A92E1702891CE1EBDE860
SHA1:	547296ECAEE8CDE51067C48E4A4E0941CB91882A
SHA-256:	F04849CCDFFD6648ACC6BBF57A694E7CFAA535316B9174FD0B239C437F6BB1E5
SHA-512:	FF088CDD33AA034A96B2BE0E9A31DBF60D52C39BD1101DAAE47104B06FF14594691478A75EF9BDA421305DF282EA9F8C2C384DB78C0D12A643CF99D3EA83DBFF
Malicious:	false
Preview:	...S@._......}.F...R..{..m<..S/..f..d#..P..<.4...Oc.....R..==================================================================================..; Title .........: RichEdit_Constants..; Aut.'..z...........h.Q.r[......7t...2..u..w$.....r.....6;....H...n ...: <a href="../appendix/GUIStyles.htm#Edit">GUI control Edit/Input styles</a> and much more constants...; Author(s) .....: G....j.......f.X.zk..f..m<..S/..f..d#..P..<.4...Oc.....R..=================================================================================....; #CONSTANTS# =============================.S......O.....{.X.zk..f..m<..S/..f..d#..P..<.4...Oc.....R..======================..; Messages..Global Const $__RICHEDITCONSTANT_WM_USER = 0x400..Global Const $EM_AUTOURLDETECT = $__RICHED.:..b..<........N.~g..7..1m..\|..{...A.#..U.)...-.....}+..CONSTANT_WM_USER + 50..Global Const $EM_CANREDO = $__RICHEDITCONSTANT_WM_USER + 85..Global Const $EM_DISPLAYBAND = $__RICHEDITCO.=.qb..?.......s.h..:x..7..?o..N6...b.

C:\Program Files (x86)\AutoIt3\Include\SQLite.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	56915
Entropy (8bit):	6.680710941312092
Encrypted:	false
SSDEEP:	768:Gg9G30APn8l1Q3w2slIpVazmT7ZKRhXlxjlvEk7UFEhPSRuhWrq7Mn:WIp27RXZu0FsPSRDr5n
MD5:	4BEA424DD78F2112DCD9BD8533AA6A71
SHA1:	3FC88F7B36EFA2737F709CACA47ED540B5327AE8
SHA-256:	37EB8652A4BA33E71B033A345031AA5DF6B933F9F9FC4649B2F58A4D81D1900C
SHA-512:	DB9BC41D6664711B64D3E13644F029154329459A733110709E8747F5F587578BE54FC7D52F7A1544A0230545780810852B939E8D63BEFA22F5F05580C6103650
Malicious:	false
Preview:	...........(T.(B. .@;W....'..i......K&.......v]..../..M...mu.ine_Modified....#include "FileConstants.au3"..#include "InetConstants.au3"..#include "Array.au3" ; Using: _ArrayAdd(),_ArrayDele.....>.....(8yhC.gm8}X...8+T.i..b...h.m.....#...+....H.Q.)...; #INDEX# =====================================================================================================================....A.....cw%%..`N.d....(+y.. ..8.....?.....#...}.M...s..W.nguage ......: English..; Description ...: Functions that assist access to an SQLite database...; Author(s) .....: Fida Florian .............1o'..>.?T.....\|`Z.....b....h.<....7W..C.G...D..&.=======================================================================================================================....; ---.....L.\....`t&&..cM.s.....qcY..-..a....e.`.C...4...c.Q...T..6.-----------..; This software is provided 'as-is', without any express or..; implied warranty. In no event will the authors be h..........."++jE.Cj.~U...9=T..i.."..P

C:\Program Files (x86)\AutoIt3\Include\SQLite.dll.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	611
Entropy (8bit):	7.015697746157304
Encrypted:	false
SSDEEP:	12:iUuJ4YIivDO3VNNz/696k15nvrzR8pWLRC:iHE+Dmz/25vpD4
MD5:	0F085AA5B86B5186F59007B6D1C1761F
SHA1:	0EA0A20D6F44EFE8B34F39FED09399B302658A49
SHA-256:	0DDDDC6560993D92BD67CBE882F026E69E45DF992D3F4F5A381B1413F7BF8559
SHA-512:	D6EA4209B3CCABBDAEA40349B2F5BF0EB7FFA0D34FE51E44E9CBA108D62427211AA44E63C1CC122927EF3A0CA2EC2B7A14D8208165FDDCF0E43059CCA0A919F4
Malicious:	false
Preview:	9@A5.......52i..........[..].\..,>.}~0.db..C..d).Y.Z..g.\9......f.%4....=<.78=....&.W...P..Z.m.%!:..;f.\|W8. .."{.N.[..l.`..V.E..3B(`.S...UTht/...P...r.3.3Z.t.$&s.ge?.k.m.#.#l.'....1h.\B......jN....h)5.2i......M...[..].\.cHY..;v.'4..A..e9.^.Y..o.b..T.F....EndFunc ;==>__SQLite_Inline_Version....).......}=.H..NI...<k..\..1q..W....(u^..2...2....t.K.w.w...A...HR.L.R.)..2i.,F%'.....d...X....-.Uu..b....d.N~j...T.=..:.l...k....'.Rb.O.v.RX...=..V.wgS...."....Y.0...B..T..)..#..,...#c.E.....".................................................................................................vux2f891j9j.

C:\Program Files (x86)\AutoIt3\Include\ScreenCapture.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11343
Entropy (8bit):	6.490436248566944
Encrypted:	false
SSDEEP:	192:EewUEzewJeEeV8eDee4tjZhdiJQJS+ghxslLk9p8c0QMSSpBLJeq2HGJt0U7nmxA:ezGNoLSVxslLO0B22exxAb
MD5:	BD640EC1577CDD6D8D51BEF3070C1C22
SHA1:	2263837829C9804CF1BE53E0AAA4B412250DB697
SHA-256:	01D021EF9D6594619F504043618D698BF9E23E1A244801E45BA9A7B950FA96D2
SHA-512:	607AD2D9C0A2F569563EC5CB6C25C49125D3762E0873A890A474DEDDF91ED45ABD15D4F7B4DBF7AC3DF8B2B36676146F9FFB72B82877660C3F2EC28BE6E1F5FA
Malicious:	false
Preview:	.k...\{..2rZA+..]./,/e=..@A.5..z.......A...DfMgGNN..Ea.%.08R..rnals.au3"..#include "WinAPIHObj.au3"..#include "WinAPIInternals.au3"..#include "WinAPISysInternals.au3"....; #INDEX# ==========.?O..."P.`!......C.\|r~-d.._;.Ay.2C......_.T....?ZQ$.9.._LdL...=============================================..; Title .........: ScreenCapture..; AutoIt Version : 3.3.14.5..; Language ......:.G...@l..W'.`C.....5&,~y..L<.:1.l........I.[`@q.Ln..l....<.R..apture management...; This module allows you to copy the screen or a region of the screen and save it to file. .g...Mv..}sW.R....1*N.b..B&.\d./^....B...A~He.@9..q....y.Y..various image parameters such as pixel format, quality and compression...; Author(s) .....: Paul Campbell (PaulIA)..; ==========.?O..."P.`!......C.\|r~-d.._;.Ay.2C......_.T....?ZQ$.9.._LdL...=====================================================....; #VARIABLES# =========================================================.?O..."P.`!......C.\|r~-d.._;.Ay.2C.....

C:\Program Files (x86)\AutoIt3\Include\ScrollBarConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.050454064110725
Encrypted:	false
SSDEEP:	12:kgtnvil+yynf1ynfwpY98XPy+eynfvVfTVgOd5GdbIwBYC:kgtkVU9U8zfy+eUF7VfdcUwB/
MD5:	2C6312413263901EEC8D14AE4546A343
SHA1:	84D174071E392B3615B94EB08185AE1CA1DD8473
SHA-256:	D4E90F288B8F085E986FA91852341383B2906ED87388CBC3C4F07B9EE9E141D0
SHA-512:	EFD42A4C972D2773A36141317C6E5736AFB528BC8E24E93CC3A0617A257C67AFD49B651CE146CFABB335D510C70F57B337843F5888880432794DB4B6D59FEB44
Malicious:	false
Preview:	."..b....8psR"2u......i.qp..8=u.v........Q..O.0.L...EX&...]...vCW3.R..j#-...E......!.)m..feo$.)...[.RG.....>.\|. .CE8...%...vCW3.R..j#-...E......!.)m..feo$.)...[.RG.....>.\|. .Cu....q...kPD .A..y0.\|[..R....C.{>.:6&j......./.O,@.BG.m.{...MV4.........i...Dw0>...V......u.\|]..{.7j.f....F.AT..zK.w.'.o...h...q."......Iwq\|S.V..W.....4..37 1.=.....\...H.;..>.\|. .CE8...%...vCW3.R..j#-...E......!.)m..feo$.)...[.RG.....>.\|. .CE8...%..================================================....D.0....?a..{.t.J......%]..1..%[.(...P..}.....#.%........b......h.R......R9..!....Rsc>.>Mu.t......71..FEX......J.......9....3...BS....c.YE.~..`.a0.B.}~!.D.I:v5.2.n.. *A.]H.j.\|.-..W@H.h.....A....<.............................................................................................vux2f891j9j.

C:\Program Files (x86)\AutoIt3\Include\ScrollBarsConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	2275
Entropy (8bit):	7.651991314690144
Encrypted:	false
SSDEEP:	48:bZjm3LZjm3xeo1bXlZjm3LZjm3tcca3LZjm3rf4Hp18Bfz/rkT6xcEB7Nm3LZjmc:dMieo1PMKoUeUB7/rkTAcEB7NMgCH3
MD5:	CA7B14F5AADFBF451146C99290491EA1
SHA1:	7E4AFA4075A7453BDCCD8B9EF25C95CEA925DDCE
SHA-256:	3ED24ED03E28A388B41BE0C390A6F0250B103AF06D556B6A056B3615DE68C26F
SHA-512:	4674A040420BF83D74CA2E1946E987F37D5BCC4A6106DFF91B744C17DCAF2045074B46007B7BEDFDF02669BAEF4666A261731D61AEB98B9D91A9360BEC7E4C06
Malicious:	false
Preview:	....!}.y,{R.....SC.`..z...U..]<.s3L..O<...uf....}'.Rc...4R...C.p5O!<x(...#...M7....d...U..]<.s3L..O<...uf....}'.Rc...4R...C.p5O!<x(...#...z1.p..5...F..N/.` K3..s....:....i..0...)...7.m^.nr,z_..>...A>....b.......f.n _=.\/...&<...M..O.....y...^.c&H<B{B..p.....x.w..6.......t.-z.\|../...h....22.F~...3O.....a(5}s<5w..m....^$....d...U..]<.s3L..O<...uf....}'.Rc...4R...C.p5O!<x(...#...M7....d...U..]<.s3L..O<...uf....}'.Rc...4R...C.p5O!<x(...#...M7....S...H../O..O?G.Q!...uf....}'.Rc...4R...C.p5O!<x(...#...M7....d...U..]<.s3L..O<...uf....}'.Rc...4R...C.p5O!<x(...#...M7....d...e...n./bQP..r........:.On....N.......g.oue1b..A..s.P7....k......m..a.`.R%.........`'._&...e....^."f.h!aFx..J..w. E....i...e...n./bQP..r........:.O....-<..,..O70!aFx..N..q.P..m.....H..)G..\0P."N...BV..."{.O.....-<..1..(O<1H.v..\|.....d.P.....-.@<...{T..c...4....dI.0.....;b....,dR_n+fE..M..v.$B....T.../...`.nM.}..!..........\.Oc...e....^."f.h!aFs..W..f.7B....h......m..a.`.

C:\Program Files (x86)\AutoIt3\Include\Security.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	18390
Entropy (8bit):	6.3663350814781365
Encrypted:	false
SSDEEP:	384:hsUHmeyhpDYNGY3d+qsx+5AUHmAQr+5/8cmpXHukHm9a214iv0UXa8i0hsqQY8NE:IVgtNSY9VWA1b
MD5:	98C47914CDD9067FDC5F78F376A01C47
SHA1:	3D85354D4AA6C8AC6BEC83EE881B3B6389A46858
SHA-256:	A93E07FF9B4888E161349DB0CB4F82F92F3001BD530E9755C96CC1CC46A51D4D
SHA-512:	C232E6F12E37D7F52E470411586437AF6A3C0E1E3F24A50A01CE7F233205A61A8CB60393E39C4A31D318C163811091357340348E79898CAB47FFF140F25F2187
Malicious:	false
Preview:	..N\`...S..<......S.{'9Fx.e..:...A-.^.S'nu..ct...N0P.....0.w.APIError.au3"....; #INDEX# =====================================================================================================....1..E:.]\d.2."..7..Z(.?..(.}.L..y\y.^&o2..]\..pR*\....`5w.n : 3.3.14.5..; Description ...: Functions that assist with Security management...; Author(s) .....: Paul Campbell (PaulIA), tra..EGt..C'.]\d.2.".....3~a[g..;.n._..~A...n f..mk...c..H../{#.========================================================================....; #CURRENT# ========================================....1..E:.]\d.2.".....3~a[g..;.n._..~A...n f..mk...c..H../{#.=============..; _Security__AdjustTokenPrivileges..; _Security__CreateProcessWithToken..; _Security__DuplicateTokenEx..; _Securi...`K.9d_..7.\.{.....]&?.(........K-.^.n:yV..p...RR,Z.....w2J.kenInformation..; _Security__ImpersonateSelf..; _Security__IsValidSid..; _Security__LookupAccountName..; _Security__LookupAccoun..I[...XXo..,.f.f..q..e6,6(.o..4.4.B6.'

C:\Program Files (x86)\AutoIt3\Include\SecurityConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	8272
Entropy (8bit):	6.908627837046587
Encrypted:	false
SSDEEP:	192:eVR1Yaa0uOhLtVgZwwmCIjPC5Y4NgJLv0EY:eWUdWTKjPIY4qJD0R
MD5:	3CFB497B628CA71910F499CB4CA45728
SHA1:	97D8280700EFCCA36B077466D8EFDD8A0680F078
SHA-256:	A1A048471746983DC741D4A933E132C3E2E1F5C29E6D539D5C60C956B6C81581
SHA-512:	795648F1AF039DFAB2B5BF9BE7064A7FE603E9A02AAD6C04D06B1D420268DCAA1E19EB986BC2E043DA4859AF46138508A6B0E86CFA6E739BF8A0C97979A6BEC0
Malicious:	false
Preview:	PZh...4\|.[..n%...s..r...+...h"..\|.g....._%....I..m...r...+..==================================================================================..; Title .........: Security_Constants..; Aut.zrM.."j.[.1..8.f...D.H..;x..$.t......B]..X.....k..<[.Bf...n ...: Constants for Security functions...; Author(s) .....: Paul Campbell (PaulIA), trancexx..; ===============================N.;P..m$....6..+.u...t.N...h"..\|.g....._%....I..m...r...+..================================....; #CONSTANTS# ==============================================================================N.;P..m$....6..+.u...t.N...h"..\|.g.&....y..w.....t....k.bQ...IMARYTOKEN_NAME = "SeAssignPrimaryTokenPrivilege"..Global Const $SE_AUDIT_NAME = "SeAuditPrivilege"..Global Const $SE_BACKUP_NAM6.;M..5[.W..{x...!..\.k.y...7~...._).....!P..s..:.......y.n6..SeChangeNotifyPrivilege"..Global Const $SE_CREATE_GLOBAL_NAME = "SeCreateGlobalPrivilege"..Global Const $SE_CREATE_PAGEFILE_NAMES.&O...k.U..[I.s.!..k. .....0=...-^8.G..

C:\Program Files (x86)\AutoIt3\Include\SendMessage.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	2694
Entropy (8bit):	7.522035787678073
Encrypted:	false
SSDEEP:	24:V2vNdaWa22T2ZP42T5+nF2hmTkH7i7a0iGixp+wj229g2DC2moE0IZT9LGsLT54r:CNd43kbi7uF+wVg5NRLdL94KZ06hAf
MD5:	08EBD5778DFD33AA9CE0D18B3C19A55A
SHA1:	9F3B8E801798BCD85A960FB058441CDEAB4F6C13
SHA-256:	454F4AD9431CF6749B2AA11B2430384DC2EE5C4E7F04D38D4C19591F99BF3862
SHA-512:	7E5A72CCAED44184854F499DCFF911458675B72B8764A53B3F662E52EFE1B1A034F772799E1516DC257BF99BCF1B2259BF44FFE110C5FF7CC0228EE3E99CCB46
Malicious:	false
Preview:	.J......8.O.L.<..q..\|..f...Hq.....j3....1.....Y.4.x.9...6P....M\..j...\|....o....mx...Hq.....j3....1.....Y.4.x.9...6P....M\..j...\|....X.l.$)P...[b.....m..^..A.MdE..._.H.1.M...n..J...JA..d...o.<....._.1"P...[b.....9i.R.....7`....[}..$...1M.V......w.D.5.P..!..k.>!x..V.+.....;}.6..,.KcL...M.'.k....j..H........C.5.;...o....mx...Hq.....j3....1.....Y.4.x.9...6P....M\..j...\|....o....mx...Hq.....j3....1.....Y.4.x.9...6P....M\..j...\|...._.....g..k!o.....j3....1.....Y.4.x.9...6P....M\..j...\|....o....mx...Hq.....j3....1.....Y.4.x.9...6P....M\..j...\|....o..5.kej..K...C...2....._.Psi....NH.O.$...6P....M\..j...\|....o....mx...Hq.....j3....1.....Y.4.x.9...6P....M\..j...\|....o....mx...Hq.....j3....1.....Y.4.x...2.0M.e..$(.t...\|....o....mx...Hq.....j3....1.....Y.4.x.9...6P....M\..j...\|....o....mx...Hq.....j3....1.....Y.4.x.9...6`.......w...o....r..T.;H?.h.(.V...y ...."..PE.....Dz.e.C.M.M..P.......0.J...E...r....mx...Hq.....j3.

C:\Program Files (x86)\AutoIt3\Include\SliderConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	4578
Entropy (8bit):	7.835681910651439
Encrypted:	false
SSDEEP:	96:8dqC3kYqC1qCq8VVjrzzJKLSXHW9P2IyVFtX6wk3y3mx/jATsQY2aqCjO:840O7R8LrzzJmSX29PoFe3HATsQY2ZSO
MD5:	9A47FC36BFF97AE1356C65E730CBB0AD
SHA1:	B6B4971E0D38C24AEEB194AA016A9DC7E7962204
SHA-256:	154BA06682935620C18C4B71167D80C9F847873457728C4ABA51E92186F9E7F6
SHA-512:	EA0CB847DEAB807B193598D52C85472B3EB35EC0690771700C098663D6D989AEE568E7A61232E3018BC6E7F30DA1270747D0C7BA64F236E390307B4EA678ECF3
Malicious:	false
Preview:	...(.'...,..~. ...v.b7.C..l\|.._c^LV..SB..I.?).L.C.............v.o_..~..&.....k..D.;O..l\|.._c^LV..SB..I.?).L.C.............v.o_..~..&.....[..Y.o..Wqo..LpM_E..N,.@..pK.......c........-......!...c..(.....x.&s.&>.\64...~M_E..@E.l..n}...t...r......,..q.n...1..&.....&.N..o..u.....2..E...\.E..gf.O.+...x.......+....8.+......%.K...;.H..k..Wq"........cu..5.v\|......9......+.....+B..,..7.....\..D.;O..l\|.._c^LV..SB..I.?).L.C.............v.o_..~..&.....k..D.;O..l\|.._c^LV..SB..I.?).L.C.............v.o_..~..&.....k.&s..I......6.-%8..SB..I.?).L.C.............v.o_..~..&.....k..D.;O..l\|.._c^LV..SB..I.?).L.C.............v.o_..~..&.....k..D.;O.8ja.....K........wq.Q.=...x......#...g.4...&..v.F..7.NY.v..[7(..B7.Q...N..`..oG...^...u.....'......-.....;.^..".Y...x.^>#..B......J+.j0.A\.?.;..7......,......r...c..z.D...".J..r...%3...<..K.....F..q4.......v....&....'.<..I..t.K.9.X.."&.q....7.!QV...M..=.gz.......c...... ....$.&...d.o._...;.Y..t\.f9(...-C......

C:\Program Files (x86)\AutoIt3\Include\Sound.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	23262
Entropy (8bit):	6.520713472074832
Encrypted:	false
SSDEEP:	384:h7Kfik8ru/R1aeN3Pk0Z+tiZeKSbeh08W1nbzEys72oDdy9gwGM6hUn8L59ZTyOd:FK6RaAMPEnKKeO8kbz+72oDdA1QvJyOd
MD5:	6657829B329EDFA043BE34BE0752154B
SHA1:	E38DF192A782B342A493A505A998EF0D0589C865
SHA-256:	3802B9A8D30D6892D916420D4E0F5CDA0DE938371E872F04B280DE45C71A0345
SHA-512:	874F707870E71CCA933B2C8339CEEE2215CACE3196CE86FE0C2D33D7C2119C6F723591AD031D985CCA42E4B93EEE50F2E4671CB79895E90F0DC8F0A402C9B627
Malicious:	false
Preview:	$Dx].C{..Q....d...y.%.U...S..t.)....f......S........A.)"..B3"..; Using: _PathSplit..#include "StringConstants.au3"....; #INDEX# ===========================================================:.+...".....Y..T..P.t..D..(....z..AU/.....d...A..^..xJ..Title .........: Sound..; AutoIt Version : 3.3.14.5..; Language ......: English..; Description ...: Functions that assist with ShXxZ.[~..Z....G.?V7.<.Y.V.f....i..\:s.....<....P....$+.gsaltyDS..; Dll ...........: winmm.dll..; =======================================================================================:.+...".....Y..T..P.t..D..(....z..AU/......z.....=..@..xz...=============================================================================================================..Global Const $__SHxXz.yQ...q.;..-.q2Z...t+..5.....s.N.......d...A..^..xz...=========================================================================================================....; #CURRENT# =======:.+...".....Y..T..P*.t..D..(....z..AU/.

C:\Program Files (x86)\AutoIt3\Include\StaticConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	2291
Entropy (8bit):	7.676983155168195
Encrypted:	false
SSDEEP:	48:DVYEoGUYxVTdVFpuh4Dzl+WhEtF0WIvwhFsr/GE+Ljh9NX24T:IGUUWwBCFZP6GEY24T
MD5:	B2D767D2C8F54E884E73B01E64BE185C
SHA1:	EABB11EBC598385710D8FA4C0087E9603475DB6C
SHA-256:	82B44ABA8B5D68EA84E2A26A5FE20C72FC9E4165666A93A9C596CCBB1CE37A77
SHA-512:	F229C9AB5D490AB44C2D12ED96D3A5B2835C7591C6DA09F9E5327D17AFFD83F6232E634B23876548506D554E25C846FBC1FCFBC02EF0F930E3A3AF3B7540E38E
Malicious:	false
Preview:	...B.K...#.....W.....QB..3....c'...k...Y....W\.Rv.m....-..).......[.VpD.$2.`.....(:.......c'...k...Y....W\.Rv.m....-..).......[.VpD.$2.`.!+..An..v....p4..x....M......B..$d...Q].{.....\.F..KwY.7<.l......'.}..T.;:..x...!W....l;Tk.5d...dA.z.....NF..(..;!.r.\Q..qn..T..f.'v...>.....[...-4xO(.>c..\I.q....Z.LF..4..j3.<..@..5W.?..V.0:..%.........+.E.$.xd..>........E..!..4Y.k`.)..............c'...k...Y....W\.Rv.m....-..).......[.VpD.$2.`.....(:.......c'...k...Y....W\.Rv.m....-..).......[.VpD.$2.`.....(:.......}Y.......G....W\.Rv.m....-..).......[.VpD.$2.`.....(:.......c'...k...Y....W\.Rv.m*....-..).......[.VpD.$2.`.....(:.......T!..4.....Z....l;('.2v....~[.4....k.{F.K}.....1.N@..Vh.g..f..Y......TA......S.'..x..4{.K.......V.Y@s.u`.<..b..fs..@..\|..T..f...#U....J"^.8.p3...\i._.........fG>.vm.1.oN..a'..@..g..H..v....Q4.....]O..>d...Cw.\....m..[.[5O..H.2.MM.zi.3.f..V.......D.....gkv.$.1{....c\.0....o.i4.&.Y.9?.e.&f..wf..P..F.~>......

C:\Program Files (x86)\AutoIt3\Include\StatusBarConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	3530
Entropy (8bit):	7.781108347567863
Encrypted:	false
SSDEEP:	48:+y6ccolvxP5qyuyXjbwlBOU/PO7kz5bMUwpxpyBqMHvORU1nUy/w7Kc9:+yhvOyuyXWoYvMUwHMHzBUy4Oc9
MD5:	9E2EB070D21B9F4E9EB08A3A1F09C795
SHA1:	B2755EFAC9481316482E53C8DD6BC7A5BC164648
SHA-256:	2412AD11F8CD2A4F610691B836F4CDE74F0C2961872FDC4FC71D0440F47C86E4
SHA-512:	1246CE80474685E96A002CC35B00B2BA4DB870C36A7A0E5ADBB6EE26978FAF52CBE41E3E684DB8F4521A766B68FC0151196749325C04033F206BCDF95F05CDD5
Malicious:	false
Preview:	..4....O..."O.C..u..o...p..m.........P[X..Cs..Vi_F..P..#.O....g..Q._.S.z..s..h.......m..m.........P[X..Cs..Vi_F..P..#.O....g..Q._.S.z..s..X....S..5.9.~........D......<...:........R......:......gx.}..{....7..p.v.7........C\E..."I..Yh@.....l.....z..B.!...3#.:..3...N..%.U.".....Y..CCko..?;T..&J...C..0.H....3..L....N.5-.:..{..,....m..m.........P[X..Cs..Vi_F..P..#.O....g..Q._.S.z..s..h.......m..m.........P[X..Cs..Vi_F..P..#.O....g..Q._.S.z..s..h.......].,.s....~...M[X..Cs..Vi_F..P..#.O....g..Q._.S.z..s..h.......m..m.........P[X..Cs..Vi_F..P..#.O....g..Q._.S.z..s..h.......m..Z....U.:.....nc..'.[../..M.!......L.R._.wO...\7...U..$.3......d..cM[E..F~..a........q........?..-."....n..e....7..Z.7........w..R..E...=T.O. /..8..[.R....j..(......JH.".Q4..b.T..p.D......t..cM[E..O~..P........>.....-.........g .<.V'..,.}..2.{........c..o=)5..n..[,PK..V..v.R...z.L......0+.&.Ru.S._.$.7. ....Y..U.F....nT..t.......x......3....o.).( .".p:.U......E......w..

C:\Program Files (x86)\AutoIt3\Include\String.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	8624
Entropy (8bit):	6.203096138769738
Encrypted:	false
SSDEEP:	192:bdOe2ev+PaKF3mhLQmzRuiYdAw5GIR94W9z:bdOeT+SKF3QQmzRnYdAw5GIH4Wx
MD5:	DE5881B860CEF8A747E4948992CDC2B3
SHA1:	EB1A53DD5611BF54FF65AD28F34A7C0E28AB41CA
SHA-256:	7610D8A9392B2F8A10CD56CE200327278D1BF9364713EC5B6B30254F939A69E2
SHA-512:	233BC9E12C8BD4BD9927A36F4197BB5C78120473514A35166E70C6ABD94670C0AF9BF2F382E7FB2A96659EC9540E532EDBC50EABBFF9148900A96DDF95175DFD
Malicious:	false
Preview:	....h....h...;..9l{@W..y.p7.n.6'\..s..\#....?....:....qr..V====================================================================================================================..; Title ......."...de..;.../tamF.gO.q7.g.ci.S.3kX\w.....W..J.....,r\|..Q Functions that assist with String management...; Author(s) .....: Jarvis Stubblefield, SmOke_N, Valik, Wes Wolfe-Wolvereness, W... ..~+..C..2,.nV.s.RH;.l. ic..y?.^b....X..\.S"..5.3.b#, guinness..; ==================================================================================================================......1....0...;....U\vw.e.R?c.4.dt.@. gQO..........N]...oo..V==================================================================================..; _HexToString..; _StringBetween..; _StringE........yy.V..?rz)8..u!v,.g..;@..oWfIb...\..].....Hir...ringTitleCase..; _StringToHex..; ===============================================================================================......1....06......g=3.....O?c...TC.].[

C:\Program Files (x86)\AutoIt3\Include\StringConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	3168
Entropy (8bit):	7.754676693402763
Encrypted:	false
SSDEEP:	96:ozTk5gMeozL/FgA85umqYWLpNiMWqeLM9:jgMeGV85XqYXLk
MD5:	61994A28BAA0A0D14F452E60541F8B1A
SHA1:	CAD410D8CA51CE99A41F43C6E5B197B7B3B01B95
SHA-256:	34789A9188C50EDDC1AB1B1593D58255E17A1E54A7E9290B521F8CAAA7424D14
SHA-512:	34CF35AA4A65BDF40EAFD9D3E1F8A3C026369C20AD338D224BE4FF9990CC6296B2D8EFE73424F5BDC53F987D8BF38AD6A597AC80E4FE9E13BCEB346353BD88D3
Malicious:	false
Preview:	%.P3.}..{%?xn.....\|...[..V.......:.....-...Kp..J..%.4Za..D.B.;.;..m.5[.kwl&6..!..a.yi".mH.......:.....-...Kp..J..%.4Za..D.B.;.;..m.5[.kwl&6..!..Q..tK.$.......).....C....p...l.g./..B....i.r.h5.{..8jk;8..2..r.I^$......U..)........!.@...#.M./.......h.(..j.K..%>0u...h..>.d=q.<........fF.......~.@...h.).4..Y....a.U.L9.oF.#$2ob..o..V.d.j.8.......)....e...>..W..u..\\|..D.B.;.;..m.5[.kwl&6..!..a.yi".mH.......:.....-...Kp..J..%.4Za..D.B.;.;..m.5[.kwl&6..!..a.yi".mH.......:.....-...Kp..J..%.4ZQ..s.\.I.U....[E.kwl&6..!..a.yi".mH.......:.....-...Kp..J..%.4Za..D.B.;.;..m.5[.kwl&6..!..a.yi".mH.......:.....-...Kp..J..%.4Za..D.u.&.r.W>.K..&+#~'.h..2..:L."Y...F..YUM...u...>.R.....2G........u.o..#.z..1j>kn..h..2.d'w.%...Q.._tM....c...(.90..z.eG......[.R.Y.q..[#....^+..,..\|.+ ?.1...Q..WsA....t...!..z..t.k.0......".R.a..[#....^+..-..\|.%'z.#....@..[."...q...#.GW..L.V)...*..:.U.D.m..([.djj;E..<../.d'z.#....Q..KtA...0.....P...y.`.3..s.D.U.t.P7.\|..&..;H..o..2.7Y..p<...W..[t....d

C:\Program Files (x86)\AutoIt3\Include\StructureConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	64599
Entropy (8bit):	5.547525183690798
Encrypted:	false
SSDEEP:	384:c6vAyZcqjkLmz6be22gnlzHlrQLCgzihSW0ciYiTyQDG1zkjSGidJxOEJMWGTiIa:pvtUZs3qrWzPgbnGJs/rpnU8RwnuPR1
MD5:	338A2D1F44487405B231D8C2A35A2539
SHA1:	6FCB6FA68E273E9FF4697C13C177F17B46C043FA
SHA-256:	91DAE519F1FABAC666412B5CF1A5F8EC23FF522C1A1DD6DF6878697DAE81F59D
SHA-512:	B93E10F31F96A88700A4ECFACC08369E7F442620962B2A07269769D74D3E96EB8C28A3407B64C6694C6421D3963224D5C4BA8251EDB37EC3403B980F35BBF3FB
Malicious:	false
Preview:	g'..nk.&b.G&.....P...W.NCO.$..J.h.M...w...Da{F..@..F...E..==================================================================================..; Title .........: Structures_Constants..; A1:..v>2&=.@.. ..].....U^6]j....<.....d.....d('..S].E.....S.ws API functions...; Author(s) .....: Paul Campbell (PaulIA), Gary Frost, Jpm, UEZ..; ==========================================ys..?#Y~r..x..'..N...2.SCO.$..J.h.M...w...Da{F..@..F...E..=====================....; #LISTING# ===========================================================================================ys..?#Y~r..x..'..N...2.ctI.=..'...$2..j....+R..v..].^.Q..p.NS..; $tagSIZE..; $tagFILETIME..; $tagSYSTEMTIME..; $tagTIME_ZONE_INFORMATION..; $tagNMHDR..; $tagCOMBOBOXEXITEM..; $tagNMCBEDRA....KPiIt..1..T...6...F.ctI.=..9...=}......s,\|b..G9.z)w..=:.; $tagNMDATETIMECHANGE..; $tagNMDATETIMEFORMAT..; $tagNMDATETIMEFORMATQUERY..; $tagNMDATETIMEKEYDOWN..; $tagNMDATETIMESTRING..; `:..GH!...f...Y....y...n.):;hF..2...1m

C:\Program Files (x86)\AutoIt3\Include\TabConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	6507
Entropy (8bit):	6.641337848225666
Encrypted:	false
SSDEEP:	192:iQrUQasRgBCE0RDymSCuBkTcYQ6ZzClrAVNiEL:ieVZRXqMTclpdAPiC
MD5:	5557852C7A6CE4AC47F97F875BC35AA2
SHA1:	49FA91A338CAA02240CE4099FB9319A8181671D0
SHA-256:	44DB89F9B898D1613686AA3EEE535195209D02B1F2AF8DD925E03B5D3D106E2E
SHA-512:	5BAD0FFB427EED82583092EEDE54A112C7354FBC068417C501DB4EC1765847EE0AAB4FB246867D70B9ACDC4B74FE7FFF945499C145B6BAE9BF0BB183CCE218E4
Malicious:	false
Preview:	$M..cG.~............*}........E.j.".V...a....W.{...l....)c..o==================================================================================..; Title .........: Tab_Constants..; AutoIt VbV..`\.!............C....%...V.y.1.K..P0U...`...O..#..VV{0..\|: <a href="../appendix/GUIStyles.htm#Tab">GUI control Tab styles</a> and much more constants...; Author(s) .....: Valik, Gary FrhW../..5....=....^..........E.j.".V...a....W.{...l....)c..o===========================================================================....; ===============================================:...2..&....=....^..........E.j.".V...a....W.{...l....)c..o================....; #EXTSTYLES# ==============================================================================================:...2..&....=....^>....#....$V?.?..h.d..+...z.....pl4c...b0000001 ; The tab control will draw separators between the tab items..Global Const $TCS_EX_REGISTERDROP = 0x00000002 ; The tab chJ..`^.\|.......s.n<t.........#Ky@...

C:\Program Files (x86)\AutoIt3\Include\Timers.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	12166
Entropy (8bit):	6.382556446120079
Encrypted:	false
SSDEEP:	192:ULjJ7aK2BxIdD9lHH3CzvOl8ah1l2klefo7ljze0S6Rfqe+fUq9PtxOiekhcDvqs:ULjIKZdRl3Tl8Qevo7lrqCoEoEoQHV
MD5:	B846C13113983FBBD88F8CF73858BDAE
SHA1:	1403130E0DCD03CC3F18AA0694F65CDCE3ABFB6F
SHA-256:	A9875BA42880BDEE2A4D0C3A032F5723E5A67582361135CE89E97FED5A0F9BE7
SHA-512:	21D1DE818FF91E486AF6D995DD8CAEEE44361AA5A2173F569D48968B00A73AC0B46ECA0F02A7DB46051EE7DA976C7FB63C83374345E7A4FE4F91E607E9CC966B
Malicious:	false
Preview:	.....6pz........3z&..I.(.............8)+w..IY#...,c.A.g.v.B==================================================================================..; Title .........: Timers..; AutoIt Version .OCK.m%+......p.f8...".%.......N..D.$...Aqe)....w..?p.F..G%\.ions that assist with Timers management...; An application uses a timer to schedule an event for a window after..P..&wv......{.{8...`.{..............%46j..TD>...y~\..?.?W. specified interval (or time-out value) for a timer elapses, the system notifies the window..; associated with ...E.yz.....m.38O.a.y......[..N.M.Xkpej..T.v..h-\..zQ'P.k rate and how often the..; application retrieves messages from the message queue, the time-out value is only a.....y~.......k.{6...%.%.......H....[.I..-j..IY#...,c.A.g.v.B=============================================================================================================....; #VARIABLES# =.RMX.~)".....#..dR..1.6...........

C:\Program Files (x86)\AutoIt3\Include\ToolTipConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	5840
Entropy (8bit):	6.653169009437166
Encrypted:	false
SSDEEP:	96:vYCJ3kJ3iZNtgwuxPKdTm7VMd7cOoyYkptchUCC:vYCVkViXtgwuxPKdT8eWSNSUCC
MD5:	4DFB2702A30AB1F3CB8B6DB594031562
SHA1:	23C06B4B48BA1E87E261D88C809F05C2E9F59F02
SHA-256:	92DC72B0517092A7CAC0CE0D0392B795CBB90FCC63A2D00DAFFE2DE4C26EAEB6
SHA-512:	E391C982AEBE3D76B0868D0DBCE1E7A22E2E608652BE40D14CA13544D2203CAB0169927F7686E3A686F69558A4778D12457A32483BBA0216E43230415481EA45
Malicious:	false
Preview:	..i.A.y.OB6....H..mQig.a..mm.j.....P6`...j4..T^.wf.e..1c...U.==================================================================================..; Title .........: ToolTip_Constants..; Auto..'&H.n..Cx..6.3l....'....N7%.0.....C%g.~@0e...n<q{.=U.~7..... ...: Constants for ToolTip functions...; Author(s) .....: Valik, Gary Frost, .....; ===========================================..:M.. ._.e..8.=...."......mm.j.....P6`...j4..T^.wf.e..1c...U.====================....; #CONSTANTS# ==========================================================================================..:M.. ._.e..8.=...."...O.g<?.6....^..+ygoh.@..:+a...e..tn...X.01..Global Const $TTF_CENTERTIP = 0x00000002..Global Const $TTF_RTLREADING = 0x00000004..Global Const $TTF_SUBCLASS = 0x00000010..@.B.\|.Bn7.q.$....pMla.b..`(.g.....`.._TL6e....E>{..r.S....$.TE = 0x00000080..Global Const $TTF_TRANSPARENT = 0x00000100..Global Const $TTF_PARSELINKS = 0x00001000..Global Const $TTF_DI_SET..B=..=...h..=.0r..$.o.1.A75.Z...R..+

C:\Program Files (x86)\AutoIt3\Include\ToolbarConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	14047
Entropy (8bit):	6.819041615709756
Encrypted:	false
SSDEEP:	384:+QsXVsKM2O3hBfzTKLcCZBsaetBluVEfENi+gs0:QX6p2O3hBfsTqPluVEfENik0
MD5:	81D86879D8BFF245555E59E78DC7A461
SHA1:	3767A5A9111C7865B106BA17C3911A7DA6CCDD41
SHA-256:	8543E8E80999522CE567AA0CF652A8C339AC7DFBAE4186D60A9171A30CD9FFEF
SHA-512:	7A7FD773F64B9E2172BBF8FE6093BF9F9C01E71788FE9CFDD8C352506A881676FFE8C942D020B88F1E84727488C28DFFB38F1F500E5C2D616AC70E10AD2256C5
Malicious:	false
Preview:	..R.x.V#...!:.Z........;;..7...Y3.D.Wt7cn.....i.5...ph.W.zd..==================================================================================..; Title .........: Toolbar_Constants..; Auto....q.A/..x..~.....P.CT.m..H...W..Dg0~..M.z.<.....(&...7-.. ...: Constants for Toolbar functions...; Author(s) .....: Valik, Gary Frost, .....; ===========================================....)H.{....b.m.9....g.^%..7...Y3.D.Wt7cn.....i.5...ph.W.zd..====================....; #CONSTANTS# ==========================================================================================....)H.{....b.m.9....g.^...f..N.......i....l.Z...M...}-.Z.wi....Global Const $TBIF_TEXT = 0x00000002..Global Const $TBIF_STATE = 0x00000004..Global Const $TBIF_STYLE = 0x00000008..Global Con...@7{.........9....j.S(....C.l.....'ys.~.Z...G.v....W.w!..00020..Global Const $TBIF_SIZE = 0x00000040..Global Const $TBIF_BYINDEX = 0x80000000....Global Const $TBMF_PAD = 0x00000001..Glo.P.W.\5........Fi...z.C(..:...T>.t...&

C:\Program Files (x86)\AutoIt3\Include\TrayConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	2976
Entropy (8bit):	7.7697352110078715
Encrypted:	false
SSDEEP:	48:DCauUcWvfHmC9/Bca2yooO9j+mEBpphocjVjskUQqpcZkqyXgi7uM:ma+WWC1BqLS7fjVAxpcZkRz
MD5:	1AC36A51DD9DDEAAEB1A4EFAF8FED8AA
SHA1:	E997E0D2EC81F963FDA3B1EBC809BF1170AE16D4
SHA-256:	1E71A65B50601FE50219C056ADDCF04DB747A576AF8A360F6C57BECF45225C49
SHA-512:	9DAD6291D073181E656EA375885BBB99D6B3D296B036232FC7C8060A29F35202E7A52A1A4B66E291CA320454C54297992FECBF09E289D567BF3A126F6B1B409F
Malicious:	false
Preview:	p.R.K.....}.5.Cc~t..`.....rPgH.[....{.kp....D....;......X....n........@P#X..sTxi..........rPgH.[....{.kp....D....;......X....n........@P#X..sTxY...L..H3.aCt[.H.....8>B....0 ..G.BN...3....<........LY0P5.uI.5...B...=.aCtO.#..5.[G....^XMCr.YO...K...=.H.J....M\|... .)!...L..L}...........5.$$F..s..eFr.YS..E....}..._....A>+M.=. &....G..~..(Az=......f.xc;...D....;......X....n........@P#X..sTxi..........rPgH.[....{.kp....D....;......X....n........@P#X..sTxi..........rPgH.[....{.kp....s0 ..%.yo...+....n........@P#X..sTxi..........rPgH.[....{.kp....D....;......X....n........@P#X..sTxi..........rPgH.[....{.kp....D...>..<......6.Y.P...4)9.5...6...J..Y3..?.,./..........t7mH\d.Z...........e.j...-,K6}.sIqY....G...P.!..U.2......i..i...1.<,...1....>.R..W...].j.L.n.$8.../..Bq.#M..........u..2xn..&.;+.......<.O......$2K+{..*.........j..-.6U.....b...o..8.fa.;..........s.S.J.../,G:\|..(......... ..#.8..F..2.r.d..?riq`&......o....2...P...Y9L$a..,..........!.E`PN.2...#

C:\Program Files (x86)\AutoIt3\Include\TreeViewConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9715
Entropy (8bit):	6.7509168396685455
Encrypted:	false
SSDEEP:	192:gMVkQUigi7Cc6pNXchhFU+6ZxEWmd2DhejiWTdBhANpG:gMiQUDEx6NshhFUTnEWI2DUWWTdBaa
MD5:	9C1A84718BDE8A33B326AEA0A24E12EF
SHA1:	7199146AA62729E5352D40C649C57BBA144B6076
SHA-256:	A241449FA191C8149FCB0F0E808378032F6EAB69DC2E620864BD16D3A987E1F4
SHA-512:	4CCD3AB2DFF27A057A049DC6C5E316B378A7A9B3840B248F2509D8B5DCAA2EB26393B94A908FF8A50B7577DE94748A544C80EE3A39EC6205AD3E5DD6133F755A
Malicious:	false
Preview:	.y..........N.Z&KX...f.j..(.yx....FdM...dGI,..:......4..E.b==================================================================================..; Title .........: TreeView_Constants..; AutHY...._..T.c.y.^I.../....t.#0....Uw^...y?.v..o....jI...D0n ...: <a href="../appendix/GUIStyles.htm#TreeView">GUI control TreeView styles</a> and much more constants...; Author(s) .....:.F......q......8_.T.....8..(.yx....FdM...dGI,..:......4..E.b==========================================================================================....; #CONSTANTS# ====================.-K.......I.~.j.ME........(.yx....FdM...dGI,..:......4..E.b===============================..; Styles..Global Const $TVS_HASBUTTONS = 0x00000001 ; Displays plus (+) and minus (-) buttons nBh....W....c.#I.....N.P.5.++.../.#....3:T...'......9...C..ses lines to show the hierarchy of items..Global Const $TVS_LINESATROOT = 0x00000004 ; Uses lines to link items at the root of tOuV....Y.~./.5M.X...Q....C......r:.5.

C:\Program Files (x86)\AutoIt3\Include\UDFGlobalID.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	7003
Entropy (8bit):	6.537506045115929
Encrypted:	false
SSDEEP:	96:nMgyu/PJGiukQryzyHuAKLZnEeNZi3Hr22xyo7CY:Mgyu3J1ukD4mLZEeNZi39ApY
MD5:	D94CB8D758186C40A2E1C5894C22DF9F
SHA1:	69E588184BE32D9944E1756000455294A4FC4364
SHA-256:	CED85D11BC4774921B43D6F4158A5E87E740E44CA0A128F899F2867C0F702BFA
SHA-512:	A8BBB5E1A6C44E267BD24271811617B89F7917663001E78FCC5B94F82D239E016998A4087C667D69A036A604BF7B9DCE81DDDD41E707CBCA9FC658684051BEBA
Malicious:	false
Preview:	..E....PeTk(A..z....6...K8...M.I....c.;?t=....'...:)...o====================================================================================================================..; Title .......]_~Nm.~........ah...J#.!.X.U...L.idt1.....?...!.....r......: English..; Description ...: Global ID Generation for UDFs...; Author(s) .....: Gary Frost..; ===========================.....@7.5pq/.M..t..Vn....q.h.3...Z..Q-.gwz".....9...r_7.o====================================....; #CONSTANTS# ==========================================================================.....@7.5pq/.M..t..Vn....q.h.3...Z..Q.3.&(}.....w...7N...>obalIDs_OFFSET = 2..Global Const $_UDF_GlobalID_MAX_WIN = 16..Global Const $_UDF_STARTID = 10000..Global Const $_UDF_GlobalID_MA..b....H?.;xA..z...+..K...Jl...[.a.2.#^j...K.....F...B7...b0010000..Global Const $__UDFGUICONSTANT_WS_VISIBLE = 0x10000000..Global Const $__UDFGUICONSTANT_WS_CHILD = 0x40000000..; =======.....@7.5pq/.M..t..Vn....q.h.3...Z..

C:\Program Files (x86)\AutoIt3\Include\UIAWrappers.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	110355
Entropy (8bit):	6.855085337656606
Encrypted:	false
SSDEEP:	3072:0/Ne/hRpbQXXNzmWa0wZZRJyNFdz1d6RWeXVEC5:0/Ne/7yXyVJJyNz1cx3
MD5:	F7844CFC620EE34DC4945F44B2CA2301
SHA1:	8BB9F4A9BE8172DDD69B89022146D5A53DFEA3F8
SHA-256:	D472AF98424318D4616EBDBA9F9AA26D6280B67565396E986551F64A8A1D9140
SHA-512:	3E65C0F9A1E13C027E6D714DDC32C1B4E4FF7B1C9DDE931513F259681A8A0F7206C950D7B58726E12C8B96BF3A8EB7D16FC419983854D39E9801395821898DA5
Malicious:	false
Preview:	M..4..../.....{.4.M.,g.RM.1,L.......k.{`..W.\|J.p.....A.....w 5 -w 6 -w- 7..;~ #au3check -q -d -w 1 -w 2 -w 3 -w- 4 -w 5 -w 6 -w- 7..#Region includes..#include <EditConstants.au3>..#includ.......:.....BKf...B..kB.<4M.....X1..".E..?I.l....=.._..J.Pe <AutoItConstants.au3>..#include <WinAPI.au3>..#include <Array.au3>..#include <ScreenCapture.au3>..#include "CUIAutomation2.au3L.......'....Y.r.@.B..\|..$5Y......R5.<".Q...^./.._U..Y..C.Vekes/Home/windows-programming/dotnet-registering-an-object-to-the-running-object-table-from-a-non-com-project..;~ TODO gethistog...4..../.....'.I.,m."..5"]...........Q...O.2..Rf.C....aIElement, $UIA_BoundingRectanglePropertyId)..;~ .local $name=_UIA_getPropertyValue($oUIElement, $UIA_NamePropertyId)..;~ .local J...{...)......Au.F..b.nI.pc......>.....r..&o.!..._k........t[3] + $t[1], $t[2], $t[4] + $t[2])..;~ ._ScreenCapture_Capture($name, $t[1], $t[2], $t[3] + $t[1], $t[4] + $t[2])..;~ ; Find a ....{...n.....7o<... o.n..1.F.....^>

C:\Program Files (x86)\AutoIt3\Include\UpDownConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1465
Entropy (8bit):	7.355740068623054
Encrypted:	false
SSDEEP:	24:bfdJLriL5JQF1uC2bZ0pLriL2DriL81aHwfTi/j9HUvsxYiL1RRbnpTvg0H+iGg:TdaQFT2bZM5aH44pPRRbpjg0H5Gg
MD5:	EA401C4D3D27D27867CCDA63832ECB06
SHA1:	98B499091CE6ADB226370B68697C992CD7160887
SHA-256:	9648353D134B711679E0AFEDB3922B0C6920D3820D58870E34AC8471DB477E61
SHA-512:	D161C27E51A36CAEB3375B5AD774D491D6F0B7F7CDD6D75F41FA8BDE4D736C3225583D9CF5CC13162DA1AF88B54EC1EABC69D06BE9D15D526048CA8401FE99AD
Malicious:	false
Preview:	6.Aq.....9.{.N.ecV........H...y...Q..0...t.X{...P.WJ..fB...(../..I..kN%.~.UTP...eV....H...y...Q..0...t.X{...P.WJ..fB...(../..I..kN%.~.UTP.........[...j...L...b......5....g}.......a.yw....vI8.m FXY...cK...O...j...B...c...:.hL........./....;..(.....$.~.a=FF...<....s&...7......I...k.".........{..b..a....j\y.cr..M..x....Y......a..L...&.M5...C.DY.......9.hs..T..9.l.c=FG`....eV....H...y...Q..0...t.X{...P.WJ..fB...(../..I..kN%.~.UTP...eV....H...y...Q..0...t.X{...P.WJ..fB...(../..I..kN%.~.UTP...Ua....u;.......Q..0...t.X{...P.WJ..fB...(../..I..kN%.~.UTP...eV....H...y...Q..0...t.X{...P.WJ..fB...(../..I..kN%.~.UTP...eV....&...7.......a...'..f..>.=%..{B.%..#..3.4.t..\|........4...o1......\..=......$..........*..T.fU..=...S%.skXY]....4....y....`...3...J.....E{...].ZO......y.l}......7K..A:&:...xV.....G....(......c...m.!...?.JJ..#O....h~.......v.73L<)...#...t1...t.T.........2...M.....7...l.Ja..3.4.t..\|.......4....3......#.

C:\Program Files (x86)\AutoIt3\Include\Visa.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	40287
Entropy (8bit):	6.504047777730198
Encrypted:	false
SSDEEP:	768:NV/17wttpG1trkKcj/yO8nCXGTIm5nKsGSVk81wapkK6:NV9oGYKcjyO/2WSVk8a1
MD5:	ED3E1D9F7C2003347E7B1BD9D6C4F2BF
SHA1:	36692076F7060F1A799042F69AF03D8A1BA5454D
SHA-256:	B0C4EBF00A19429D629A158AD2B084C5817CAC18DA19FEA837E3CB77C42D0C8C
SHA-512:	74DBA13851242D3FDFFCFA39449275FD65046B23120C1B27ED24813BE94AF419891DE7667E79C651D641BB5179B56AF8B20ECDCDAF4434C8345F558DF72367AB
Malicious:	false
Preview:	oh..?......U+....G....... .UNo.%c..Q.4MX..N0.hi..#..../.#...:====================================================================================================================..; Title ..b/.c}\E...U-D.m.i.....3......I...Oi......s.....Xd...D\|..x.Bnglish..; Description ...: VISA (GPIB & TCP) library for AutoIt...; Functions that allow controlling instrument?!.(}.E...O %.%.G......a.FLB..I...Ax.....I4...D.\m..... s.b.wectrum analyzers, power supplies, etc)..; that have a GPIB or Ethernet port through the VISA interface..; l!.msRK....d................... .Z.>Y_..h.....Vq..D\|..l.'Angel Ezquerra..; Dll ...........: visa32.dll..; ===============================================================================q<.pnOV....qt.k.......\|.[Q_..T...\e......n..on.38....G.-.o.--------------------------------------------------------------------..;..; visa32.dll is in {WINDOWS}\system32).F:.msRK....li.v...............]..^.1W

C:\Program Files (x86)\AutoIt3\Include\WinAPI.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1834
Entropy (8bit):	7.5101299765657075
Encrypted:	false
SSDEEP:	48:gdKaFs2+/o10ME9UkVJ+1YTqmMGMVuMQg/lc0AlUIe:vAJ0ME9tVJ0gqmMGMoMQgq0Abe
MD5:	39F40CCFDBF8A078E82E83C19512AB3F
SHA1:	FB2041E21B54AF211614BBEE14C5E1AFAB93E9C8
SHA-256:	93B9661AAB7E8E6C108C0C9CFBD687E2B796D7F35FA0F58CF4F1714EE3281F05
SHA-512:	5FD602C4D244E62D49250E0F1BF3FC25C8902CC240360F769A08C5AE720CCEFC4E3F677F43F5F0E2B77C79B88C1B8B56876696DBF1AB7345EFE8595815C53483
Malicious:	false
Preview:	.E.....:.=...=....S....a.M.L.3ot.=.....wi.r........s.E..vk.@..Q.B.....,.3.V.=.....Q....&...{.$eo.!.....-{. D.,7....e.U...,.\..f....O..U.;...Er...X..-.w...\.=S3._.....oo.vF.u`....S.^..7'.Z..g...v_..<G'....E...I....k...X.(U..'..zj.jt....C4...Q.y..8:.H..a.M.O^..\|B<...Ts....S..).k...X.o...q.....g..11.HU....w.Q..tD....q.Y..\..6E.3,.Bd...H.m.'...U.8C ....60.Es.v..Ga..3.^..#-....{.m.5;..qJ'PG.:5...H..@.S...i..ib.\|..DB..9.}..Sp...y.q....G..s...qv..1H>....4...m.........V.i.1.....!M.}'.oY....q....\j.G..g.I.^+...{.3..S8...0...g...\.~qi....%..-{. D.,7....e.U... .h..A.I..9..>^aAh......Y..B.m...p.%U..'..zj..!.0/.bQ..-....kt..../...AA..b.o^X..+.....].9.R...a.=.o..J].>'..[..)..-....kt..../...AA..b.o^X..+.....].9.R...a.=.o..J].>'..].r}...>....xg...E.B......{.no..W...I....w.....\|...\|..YU..!.W..Ef.........xs.~..v.[.\=...H3....b...U....f......Gn.>.....wu.R..I]....~.D..8:....q.E.\\..1j.* ..8..\|....v.....r...h.....#Y.~..Cx...q.\...e.N..`._.P\..>D~C?.Tx...O....(.?.V..Hd.~.....

C:\Program Files (x86)\AutoIt3\Include\WinAPICom.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9866
Entropy (8bit):	6.219376988748803
Encrypted:	false
SSDEEP:	96:HU9CXnlCA8+Fa+YW62Q1KOX1gzEojk5bD9SZg5q0YZVV9ga+vCXLg+bPbZWQQ6rQ:0mgb9eOKgKkDSe5tG3ay8OQ
MD5:	0A631006317946599291036327024335
SHA1:	E411A57B2C23431DA672EAAB00B8966A927CAC4D
SHA-256:	BDBFACDA5A6724372CCAAD3897A7A30D1B73DCDF7DF2CC3046BF753674D7630A
SHA-512:	CE9C2B03ADD82AB6ABEFFD06915A84FA97B6572CCA21F9DFD7761B1A98287BCC0521A7A3242B8864AC0C7EB62BE08472ED9D887318D313F841D279A8BC92B9DE
Malicious:	false
Preview:	....G"...}.Q.;..93.q.9.Mw..k...E..r.1...Voac0..C.^..../u.....IInternals.au3"....; #INDEX# ===================================================================================================.....j.../.......'g....}".!!....(@L/.~.<.`U.[....U....j.{.....rary for AutoIt3..; AutoIt Version : 3.3.14.5..; Description ...: Additional variables, constants and functions for the WinAPICo.....Z...S..\.C..3z..3.sLM.,.J..*N.q.].KE3)m/..]..HS_.wh.....=========================================================================================================....#Region Global Vari....Xw...2..Z.E..n)....fVN...k...C=A!.m.VE3)m/..]..HS_.wh.....========================================================================================..; ====================================.....j.../.......'g.. .`KPhp.....;S_<.m.VE3)m/..]..HS_.wh.....===========================....; #CONSTANTS# ===================================================================================.....j.../.......'g.. .`KPhp......).n.1.

C:\Program Files (x86)\AutoIt3\Include\WinAPIConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	5587
Entropy (8bit):	6.8402134940574415
Encrypted:	false
SSDEEP:	96:MNQgjTqtlZuBYifeOdfEi4n0KyZC5DwSCbSm:0Lj+tvuBRf6ZqScv
MD5:	20288550401878E9BEC1FB733F6A6102
SHA1:	1BAD6A83208656FED4EA3FB28DEEC011B217C43A
SHA-256:	38082A3B9CD19B5A2C110787D86846A4A0BDAD308708E811E83F7AF6C8B6DD07
SHA-512:	AF2FE3A395557CF03C46C1B10CC6FAFC99A56F4CA3BADF5C8AB1E2CA72CAFD843513A91D41DC8FBBA710E8B9C6DBF1CA8F78EE554FA9EAF224951EB9C0818F4D
Malicious:	false
Preview:	...m..K.F..<.uh."..eB..dW7.].X.....C%S.1S....N.}..;..K....j.==================================================================================..; Title .........: API Constants UDF Library...\|...Z.`...;.X#.v.._&..5.c..@.E.....J6[..U.....'..(..X......glish..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ======================..3..........E_.?...;..zJ7.].X.....C%S.1S....N.}..;..K....j.=========================================....; #CONSTANTS# =====================================================================..3..........E_.?...;..zJ7.].X.....C%S.1S....y.,..gV.5....w.HGDI_ERROR = Ptr(-1)..Global Const $INVALID_HANDLE_VALUE = Ptr(-1)..Global Const $CLR_INVALID = -1....; Stock Object Constants....`...@.y..S.uh....Hi..".y.........=9t..m......d..Yj.3......ED = 0x01..Global Const $MB_COMPOSITE = 0x02..Global Const $MB_USEGLYPHCHARS = 0x04....; translucency flags..Global Const $ULW_A...O........v....n..Dh..gS_..?.*....r'8

C:\Program Files (x86)\AutoIt3\Include\WinAPIConv.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	29451
Entropy (8bit):	5.957988331092353
Encrypted:	false
SSDEEP:	768:ANzBv3I2tjmDVieI4bm76B3Fm9Op43IP54c539MfbsapIHvP6jtriD6gnMGA4zfk:w4IC98ezuX
MD5:	A4B8559B28C06075E3508D12F3EE4CB9
SHA1:	E10E21422DD266DEA7A958B854139B141C8FBD54
SHA-256:	409690E904FEA9A44135FE72219096A7C89152CC576028A9B5B6E8BA9A8028C6
SHA-512:	797AB4D002464793EB7E74B9C7880ABE0C08365CDDE2107143403AFF71B2B11E03543B3A92004E42AFAA030E95861EBC4DA66FEFC8E48F413D0A84BB715EDA62
Malicious:	false
Preview:	..b.. y..\|QI.M47W......0P...F...>.b..f....<.w..n+p....<!.Z0i~tureConstants.au3"..#include "WinAPIInternals.au3"....; #INDEX# ================================================================.1..h .....}..`....]hM.d...@.1..:....`..h...:x....b'#.G6px .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.14.5..; Description ...: Additional variables, const..x..4s..uJD.4WU3.......=....Z...>.b.f...f.. ..um`...F2-..bE\|shied, jpm..; ==================================================================================================================.1..h .....M47W.....u7.6.U.....e..k...3....s$}...b....aJ\RIABLES# ===================================================================================================================..; .1..h .....}..`....]hM.d...@.1..:....`..h...:x....U!>...! ===============================================================....; #CONSTANTS# ===============================================.1..h .....}..`....]hM.d...@.1..:.

C:\Program Files (x86)\AutoIt3\Include\WinAPIDiag.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	33214
Entropy (8bit):	6.834237367817719
Encrypted:	false
SSDEEP:	384:uqhZ9vafej8YhjaHTo6dYBLtqJlLyjJpDBlbssD6d1IywOlHMbhtXIiCGHYKTZAB:5VFdyo6d2HssD6aOlHKhR6IYKTZs
MD5:	4CAFBC555A8CB329D85F25987357205C
SHA1:	66E7D730B214376092A7C02792FF54A4CCCAB8F8
SHA-256:	80C213F949C8CF2264A025433077FE9090AF45A3494EEFF39B83B76BF4E591A1
SHA-512:	49DBE216A95627A01D9189FEB7C8238282F4A723B2913DBB4A26886F7BD64432B90D11EE7677B56CCFF66A36C92E684E11C6EBE5AE6087C9D50600B00BAF76E5
Malicious:	false
Preview:	6....5Y.].s.m.~.e@...\|...9.......g....j..'.\+....G......14 n..ngConstants.au3"..#include "WinAPIFiles.au3"..#include "WinAPIHObj.au3"..#include "WinAPIMem.au3"..#include "WinAPIProc.au3"..#i{....%...[.Q#)..thH.J....u....\.a....W..e.l`...........}c..P.WinAPITheme.au3"....; #INDEX# ==================================================================================================(N...}.....-N].N:{..D....r.....P.&.A..>Y.`.hH..Z.....DR5:<.brary for AutoIt3..; AutoIt Version : 3.3.14.5..; Description ...: Additional variables, constants and functions for the WinAPID\|....5.....Q....unZ.Y.'...!.......$.....s.)..%...........,+N'M.===========================================================================================================....#Region Global Vag....%N..\.00...s'G.......;.....<.M.L..9D.4..%...........,+N'M.==========================================================================================..Global $__g_hFRDlg = 0, $__g_hFRDll (S..{.....-N].N:{..D.4...&.....C.5.R..

C:\Program Files (x86)\AutoIt3\Include\WinAPIDlg.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	39338
Entropy (8bit):	6.541268651671783
Encrypted:	false
SSDEEP:	384:cjwDQPv6VltSjRBFzAUhn863B2xfONeFO3Q7ESEQJPI37SRnpBYg7Mgv8sS5hRzS:MPvIaeI3QwSEQsqp+MTm6xtz
MD5:	625A15317150EB0C1E4B5D55E6868B95
SHA1:	1B64B8A9A566470895A41D7CDCAE9F2369AAC9B2
SHA-256:	7D3A29AC97D1C91847F5E80800A0FB1C528F24C19E3F32C12E5110B6512EB8FF
SHA-512:	713176AF7B32C316DBD599F1EDEBF39F68BC758E999FD6EA4795B1D141CD26E440CEE01506DABE2DA47B30A0DEB3232B92D5EB0B48121493FFEB27C762942278
Malicious:	false
Preview:	^f.]`G<....&..YI.....=..C.0..B^p...._.wUs...k.y,;:..@.`~x.=..w.gConstants.au3"..#include "StructureConstants.au3"..#include "WinAPICom.au3"..#include "WinAPIConstants.au3"..#include "WinAPIIn.j.Pm^+O]..gd.p-.?...4..8..0..KWz........i...-...:...m.MV1^..k."..#include "WinAPIShellEx.au3"..#include "WinAPIShPath.au3"....; #INDEX# ======================================================@2..1.e\...xT.ny.a...l..R^.L..;.*..M...$.=.YCe.I.%n....9&e.S..#.=..; Title .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.14.5..; Description ...: Additional variab.j..,Q7.O..+..s%.8...?.......i@7...\|.w`P. .?..S+^....qo0B..7......: Yashied, jpm..; =========================================================================================================@2..1.e\...xT.ny.a...l..bi.#.o]y....I.u.V...9..Cks..H.Gt6^...j.....; #VARIABLES# ==============================================================================================================@2..1?R&P..$..w..;...........&.;../.L.p

C:\Program Files (x86)\AutoIt3\Include\WinAPIError.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	12216
Entropy (8bit):	6.26791117713295
Encrypted:	false
SSDEEP:	192:nsjOSz99+V80ZcnabqRjVNF8G/yoqzWZdiO7II0Tko2CqVQuyAOp:nSOSz99+C0ZcnH3WGy3k37IWodkVQ
MD5:	D5EB9E14C4404E4C55C4D04FC52E4B1D
SHA1:	DE66732D4EAA9073959FF79F311D678FACA642D0
SHA-256:	A618736FAF58D219A4E4149380AAFF6E6130DC7E31A08D8A3E7294FB0691DF40
SHA-512:	804449904F63ABCCF2B91B991F8A015F9802A879360FFCC052C2B45E4E99DC5205AC182D272CF2FD62E79ECA9DEBF2536124B5C4EA04FA3030581FA113787CE8
Malicious:	false
Preview:	.;..R[....#...u..cB3.x;....X.8.r0]S.s...S.Q.`.\|...-....'...D..gConstants.au3"....; #INDEX# ===================================================================================================.oN....I..p...B.,}.`..u[...y...3f0.T..H....^.<...\|.......S...B..ersion : 3.3.14.5..; Description ...: Windows API calls that have been translated to AutoIt functions...; Author(s) .....: Paul .3..\K.......6.8M!f.P".k..;Pq.3f0.T:...U..\Na...Q.I..........=====================================================================================================================....#Region....\O.T..?.....b`J3.4..%..t.+..B.6A .%.i..q3..R...~..........====================================================================================================....; FormatMessage Constant._y.RA.........5.d..U.$...F?..B.Rp5C.2.x..v;..Q...;...r...<..obal Const $FORMAT_MESSAGE_IGNORE_INSERTS = 0x00000200..Global Const $FORMAT_MESSAGE_FROM_STRING = 0x00000400..Global Const $FOR..'.sk.'.....0.N.f..A.>k..%.o.-x..J0.l.

C:\Program Files (x86)\AutoIt3\Include\WinAPIEx.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1921
Entropy (8bit):	7.562166425425577
Encrypted:	false
SSDEEP:	48:zqhIo3tvBtQl7NFWNL94guVCvI9i+olFWNFYFWNFWhFWNFWTvtD:4f3tJtQrgu0gshRtD
MD5:	2F67EB92962E6E90DE3F602C0CDB57AC
SHA1:	F4B6F34336277B17B064482A03F60388F012049A
SHA-256:	7F8ADAF0B458A0E8DD348C17825D4E6BD84EA5FE214F9E948A6E414833116531
SHA-512:	8964D8BB04C23CC9A21AFADF5284119EA4E791D0F4A7AC683FF6A88ACC361E824D6D86141E9BD1A3471BCAA37EFC9622034242B973062611B6324155D42FBD19
Malicious:	false
Preview:	."u......Z....?.t.=..GB...Q...V.'.....9.I....%..F>.].^...eG.A.>(...AV......).:.,vO..g.s...G......X..=.......2.A.=.cG.../~....ne....P.P.!..h8....j.$.&.3......Y].....Z.....A.z..cG.?..T........E.[...0..GeO...O.#.h.J.......].....p...r.d.S...fL...x9....LY..........([U...s.b.....................2.A.=.cG.../~....ne........v..F[H...b.`.Q.........U.YC...9...i.Q.=...Ky.<..w....Z...l.\...!.E.q...V...V......0>......4..DK.Z.O...y....i.....C@..F.b......WK...s.b...n.....xl.J\..m.[!..."...7..R.v&....H....[...C.i..X...;.}.;.Y........W\..m.[!..."...7..R.v&....H....[...C.i..X...;.}.;.Y.....T@..A..~.H2...H...Z`..?~....Uzq..W...-...@....i.4..._......I.......>.F/.......#.O.u.........H...^.:..AN...&.%.e..........PA..9...r.X.i...kK...g;.....N[..F.[.^.!..[I..`.2.Q........u......#.H2...%...yA...F......FS......P.z..ExV...U.,.r........TP......9...i.Q.s...].O..h.....\P...[...;.L?,...&.`.&.D.............9...p...{...$M...k\.....\.........:.V.....*...b........

C:\Program Files (x86)\AutoIt3\Include\WinAPIFiles.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	96061
Entropy (8bit):	6.35508157039115
Encrypted:	false
SSDEEP:	768:nlDmP/S56xV+KHCwfSZedR6y+WiUkVGxoIwQYBwXZSV5+wKsTGuD5m7iAco3CWsF:qkbeLoWiYxoaYN1Dc7iAcoyWH6QwXTPF
MD5:	9A49AEBF4F61EA5E4FD6A076A42BFD47
SHA1:	6218B87C49CA4FD7FBAB1ECC79FF5D2C9C1F6A0E
SHA-256:	E8BF1F45535D886CF51457EB25D776BB47A4B6271C3C8AA2CD5D8B680364100C
SHA-512:	91B8B0EE2DDD7227AEC42BCAFF14BDCA9D1028F74B5FD558F9590D58A42B712359CBAF938B1E9F0B1B4EC8C66F057F939D16F2D2E4801AC1AE8EB1DE0259FA6C
Malicious:	false
Preview:	l.y.1....`.Y....C..j.1[A)3..,o.......d.@/.C: ..0r....t.A.eConstants.au3"..#include "WinAPIConv.au3"..#include "WinAPIError.au3"..#include "WinAPIMem.au3"..#include "WinAPIMisc.au3"..#in,.b.8..8..O.u.c......s.w3k.xt.IO2......IJ7..<..45...d!.....k...=============================================================================================..; Title .........: WinAPI Extende+.B?......o.E.m..@..i.!.l.Io..r...d....e..;..';...w).....%.Z.ption ...: Additional variables, constants and functions for the WinAPIFiles.au3..; Author(s) .....: Yashied, jpm..; ===========r.F`..R.@3...6..]..Y;.h.\6Or.W;Ar.y..IJ7..<..45...d!.....k...====================================================....#Region Global Variables and Constants....; #VARIABLES# ================r.F`..R.@3...6..]..Y;.h.\6Or.W;Ar.y..IJ7..<..45...d!.....k...===================================..Global $__g_iHeapSize = 8388608..; ========================================================r.*F`..R.@3...6..]..Y;.h.\6Or.W;Ar.y..I

C:\Program Files (x86)\AutoIt3\Include\WinAPIGdi.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	203963
Entropy (8bit):	6.39030683413635
Encrypted:	false
SSDEEP:	1536:ZuxVvT/NHsR5CfO/PmKsrR5J0nfVnVY9MCnrdCRtA95+y9hFv:UxVvbNHL70tVidCRtQtv
MD5:	94F50E48155983AD851A98CD6ABB76DE
SHA1:	713CAFEC0A74E7F3195BA0B2DFEEE939851CD197
SHA-256:	0F5C4DC0B62D96F6618B4957301638DB910028491B683613294E684B67D12025
SHA-512:	12D7DEC2D5D3FF759ABCFDF7863A2F0DDD11CCFA91EE0CB60F47B584BBBA6B67B95B7D643DF0051C3FE4F74E4EFC6AFAE6D9046C4DECC2E8868E14DE3FE62AEA
Malicious:	false
Preview:	.!..Q.;...>,M.Um........lL(W.'..Z.]X..<W'%.'\|.4.1..9.....yW.}..tureConstants.au3"..#include "WinAPICom.au3"..#include "WinAPIConv.au3"..#include "WinAPIError.au3"..#include "WinAPIGdiDC.au3".5k..H.:.... .......5...."..t....;s9...1O!o.rmtP.S......M..7...Hinclude "WinAPIIcons.au3"..#include "WinAPIInternals.au3"..#include "WinAPIMisc.au3"....; #INDEX# ==============================.u...Qc.`t}.eZ.YA...qST:.]..$C...Ko.i6.or.../.g...^.f9.2.V=========================..; Title .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.14.5..; DescriptioQh....L....) /.9.........).E'....m.]_.V3M0+.'!@M.}..z...C.3a.X..APIGdi.au3..; Author(s) .....: Yashied, jpm..; =================================================================================.u...Qc.`t}.eZ.YA...qST:.]..$C...Ko.i6.or.3....?......h.m.. Variables and Constants....; #CONSTANTS# ======================================================================================.u...Qc.`t}.eZ.YA...qST:.j..v.RG.5=

C:\Program Files (x86)\AutoIt3\Include\WinAPIGdiDC.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20329
Entropy (8bit):	6.073660299305104
Encrypted:	false
SSDEEP:	384:TND5IOwgUEel38n463wUawBsDwQhcb5T67HZZSNY9RfS+4ideXUfNiEeHlcQs:Viks0JboHkyR3ucH
MD5:	22124D74636F6878D84131969719B0D7
SHA1:	56CA5C0E37879C77E06079AA33E047101E0879D7
SHA-256:	14D384FF25DE5B1A2CAAD1E863CC50A030510472350825C9D5DAF8D9CA7CD536
SHA-512:	7D2463F179B24718A51194EF7C6E7995C09EA006092B0CD924A1915E40C39AD39A57EE28D8278760A969414445EF3B97FB8342DA6C77399D9735DCBEEE0555EA
Malicious:	false
Preview:	W...O.(..W.^g.R.......hM....\.I>...'.4K.>..0..%,.]~k..dO..X1J.nAPIInternals.au3"....; #INDEX# ================================================================================================I]....qS....?.e...P.@X $....\.d....`.t..b.W\|/...6S$[.iG...D,;.Library for AutoIt3..; AutoIt Version : 3.3.14.5..; Description ...: Additional variables, constants and functions for the WinAP='..g.b....79.......U.4.......(7...'.>..&..Qr.dd.BN\...:....,U@.==============================================================================================================....#Region GlobalT6..J....K.\l.x.......iZ......+8......z.o.PaE.yd.BN\...:....,U@.=============================================================================================..; ===============================I]....qS....?.e...P.@X .......5S...s.g..q.PaE.yd.BN\...:....,U@.================================....; #CONSTANTS# ==============================================================================I]....qS....?.e...P.@X .......5S...s.W5.

C:\Program Files (x86)\AutoIt3\Include\WinAPIGdiInternals.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	29872
Entropy (8bit):	6.617696464973397
Encrypted:	false
SSDEEP:	384:UpmRa0P5qoqMFQW4PPW6+eO1oz42o6lMoeBXE9p78OW0HptCSEkPvnwfK9VuHAzg:7P4Z0oPWJaMoetg40HAWwWLy
MD5:	E1E55B74B93E1A93F8E79D7E1354EC39
SHA1:	3380E5924D9DFA6906218FC75C62C21C1BA66CE6
SHA-256:	B3BA6EFA8DD284869FACC51F59744FA5C5A6D95B1D58A7D7CD43CC3A5A5AB1AA
SHA-512:	67D08B009D417D096E814710B4DDC92FAB2AF2C988783FB3EFE43C4F8C633F26964F43567803E68A125F20011B3F438EABB3867A5EF3D1AC772833D3392D15F5
Malicious:	false
Preview:	.Dvy8+.(%.4.../....1,........Y+...\|t9..[g...=.......'.6.8.w.nAPIHobj.au3"..#include "WinAPIInternals.au3"..#include "WinAPIMem.au3"..#include "WinAPIMisc.au3"....; #INDEX# ================..%'ic.p5.g........Fo}.......^..b....'w.Z..\.Zu.....\.y.~..%...=======================================..; Title .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.14.5.'#:.;..z.*.......Ar...-....)...qv/.K.p...<...... .%.{.I.ns for the WinAPIxxx.au3..; Author(s) .....: Yashied, jpm..; ===================================================================..%'ic.p5.g........Fo}.......^..b....'w.Z..\.Zu.....\.y.~....-.#Region Global Variables and Constants....; #VARIABLES# ========================================================================..%'ic.p5.g........Fo}.......^..b....'w.Z..k.Gu.....\.y.~..%...==============================================================================================================....; #CONSTANTS# ..%'ic.p5.g........Fo}.......^..b....'w

C:\Program Files (x86)\AutoIt3\Include\WinAPIHObj.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	zlib compressed data
Category:	dropped
Size (bytes):	13429
Entropy (8bit):	6.35200342643226
Encrypted:	false
SSDEEP:	384:AjNooBOwnDE5Rj/7iArlTu8uyT9YtrQZgp:ro3Z8iT
MD5:	B98C5224454FDA1A99026C2CB938163C
SHA1:	207758784E95828AE1C5C280A43CAA5C66B77FB9
SHA-256:	78BB9BB45672E6CBC01929ADE6937CC71C97EAB193C9A0BE15B2DC0F43B09843
SHA-512:	CC22FF644DE9FF70C47A5EE81767AE35EA5201B437C020820E3F2EC6367872EFD8566A3544B8172958C03D379DFCBCC267605C3783B7171A7CB63832BB662DAD
Malicious:	false
Preview:	X...TD..mh..L.V..c....np..N..$\X.V...s....S2.t..nV..Z#.&c.)====================================================================================================================..; Title ..U....@P`P..hw.{..~....n5.n_...nc..[..`....)d.s.......k[qc,.}on : 3.3.14.5..; Description ...: Additional variables, constants and functions for the WinAPIHObj.au3..; Author(s) .....: Yashi...RA.gJ<....f..7..7(..$..X1,.....[/...]-.C...sH..."F.;c.)==========================================================================....#Region Global Variables and Constants....; #VARIA9.....SW}:.....f..7..7(..$..X1,.....[/...]-.C...sH..."F.;c.)=========================================================..; ===================================================================F.....SW}:.....f..7..7(..$..X1,.....[/...]-.C...sH..."F..T..; #CONSTANTS# ==================================================================================================================F..5;UJ.r..@D./..k....z.^p......M...2

C:\Program Files (x86)\AutoIt3\Include\WinAPIIcons.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	24383
Entropy (8bit):	6.529818958682395
Encrypted:	false
SSDEEP:	384:B+jEt08htEtlPZlDAWp6p4Otk7xYcYD8MhT3IirejqQ9BRHWOBG4Q5C:dm8h0A66Xg4YHJ9
MD5:	CE7ADA96684AB852D8F01704E458FCBE
SHA1:	8B3872722D49F5CCC728EEBA0C8F6B358309D881
SHA-256:	B6532937E44718DBBB0414A5872503D482051067BAB069D3D8F2FEAE1D848A71
SHA-512:	0ECD025A69717EE24A43652F423A8533DA53CFDC0B4D89FDE6094490861FF8CB3FC97EC3C478E65FE12429963AC1E53DEC00C5EDFF992804329379B4323F2AF5
Malicious:	false
Preview:	./.o#._<w....<.g.N........+rT*.......I...b#CS..<.a.g.N...]Internals.au3"..#include "WinAPIHObj.au3"..#include "WinAPIInternals.au3"....; #INDEX# =========================================.{.1rU.dg........3.........W. P.Q...FG..\|w....eO\|....2.....==============..; Title .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.14.5..; Description ...: Addi./.b.../;........m.C....I.....{.....]..Z..a>EU..1...y.`....A3..; Author(s) .....: Yashied, jpm..; ==========================================================================================.{.1rU.dg........3.........W. P.Q.8.qY..(%C...7. ...}...Qs and Constants....; #VARIABLES# ===============================================================================================.{.1rU.dg........3. ........W. P.Q...FG..\|w....eO\|....2.....=======================================================================================....; #CONSTANTS# =======================.{.1rU.dg........3.........W. P.Q...

C:\Program Files (x86)\AutoIt3\Include\WinAPIInternals.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	19185
Entropy (8bit):	6.4572281842887564
Encrypted:	false
SSDEEP:	384:89tCw8zmZaOCTBqwQ2ITkueYa9PlWpqABkgsjsGqucHUcjQ:iZa7+T/SFxlc0
MD5:	E6F70E35D44EBDFB83E571ED6DCCA4F3
SHA1:	90DAD9F9F5580CEEE717AF5E67EB50DD4115EDFA
SHA-256:	49A0AF03F8D8156C7CC0DB8327F39FE005BDF0BC52112AF3662AED1FEBB6614D
SHA-512:	82E5C3279C94E69827408F3ED1EC93F0C7C6416CE41421285374DD06BF98EC675C6368103FA4948AFB26898EE5B84F9A7F5F53F27AD32AB596D5519695796692
Malicious:	false
Preview:	N..d5....Vt...H...i......1...E.-.!.W^..).g.Zc..=X.`M...o]...onstants.au3"..#include "MsgBoxConstants.au3"....; #INDEX# =====================================================================PL.:d....X....x...:.......ME..1PS.r.....g.;.T\|#.#<.8..............: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.14.5..; Description ...: Additional variables, constants ...'?....Wy.....o....d.9..."...B.......i.A27.0..-.....A]... jpm..; ========================================================================================================================PL.:d....h24...,..@.........n...o.M[..5.u../j..;.......`u...S# ===================================================================================================================..Global $2..X/...I.3.......s...../.....`MJ...\|V....i..a#./<.8..........=====================================================================================================================....; #CONS90.S.....X.*...x...:.......ME..1PS.r....

C:\Program Files (x86)\AutoIt3\Include\WinAPILocale.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	21161
Entropy (8bit):	6.29772005595449
Encrypted:	false
SSDEEP:	384:MEtTJ0G+YbipoyMioGvuL9FH3O/7UDr0QDFRjGm7T:vtTJAYbKooopPFDv
MD5:	6206681EBE30C0229524590EB5BCBEDA
SHA1:	FD007E559D6C52A0B57A71E46D20BB8A26B9222C
SHA-256:	4893AA4BD1499E51DFB3061B1C59E16AB38D5492A9CAD6CFEE862559B8DAF57B
SHA-512:	C7B8A94BF52AC51826F5C144D9D2E3F937884DE1B6F7BA89A29E540A2A1E38AE352A7E588D714807F21A447D8908D7A276677F28DF896CDDCAEFCF40BC585FC6
Malicious:	false
Preview:	..e.....-..E N.E.v_.".i..*....j...S..J......a...... @.....`ringConstants.au3"..#include "WinAPIInternals.au3"....; #INDEX# ================================================================.H6..E........y.r."..s.0...V...C4F......[...F)..>.P.N&.....q .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.14.5..; Description ...: Additional variables, const.......$..CY-.!.?W.<.y...<....@7..P.._.U...[U.Gk..E.j......4Yashied, jpm..; ================================================================================================================.H6..E........y.E....+.d...,....e[..U..R....4.\m....7_....7VARIABLES# ===================================================================================================================...U6..E........y.r."..s.0...V...C4F......[...F)..>.P.~.....)=================================================================....; #CONSTANTS# =============================================.H6..E........y.r."..s.0...V...C4F....

C:\Program Files (x86)\AutoIt3\Include\WinAPIMem.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	21804
Entropy (8bit):	6.248251598152034
Encrypted:	false
SSDEEP:	384:XaRDcF6qLkl/ioAWeJEbeqw9Y4JyKQB7XPQhPRkL7MRIv0nUBew1CEoLC7:XywBGo2x
MD5:	BF63951809A6959DEA9D29CE606D6C2B
SHA1:	E18D8EC82DD62D04C3C9E87632969DA878B5E804
SHA-256:	2AD3B13325CE72535E22FB889EF57B5AE8F5F42AD071134603574D75C4B3F6B1
SHA-512:	C49A4FB35C3DBB0C9CFC9AF7396A7B931AB11CCD3E0701A17B8FAA0C4D08C4AA18F5578399DA5AF7E8D82D432719D4B9BDA18861AAD5155749FA4E74706483E4
Malicious:	false
Preview:	....T.g..N....!jFgj..:.A......Xh5...s....^E...<.Ds....;n.....====================================================================================================================..; Title ........-..v...bG.<w..:.4....+.pt8...`...D?...;._.x-.....K.zon : 3.3.14.5..; Description ...: Additional variables, constants and functions for the WinAPIMem.au3..; Author(s) .....: Yashie...H......M...Zqy>....c.\....t.,;\|..U/....K. ...Bn0d..C......=========================================================================....#Region Global Variables and Constants....; #VARIAB.....>....M...Zqy>....c.\....t.,;\|..U/....K. ...Bn0d..C......========================================================..Global $__g_hHeap = 0..; =============================================......>....M...Zqy>....c.\....t.,;\|..U/....K. ...Bn0d..C......==================....; #CONSTANTS# ============================================================================================......>....M...Zqy>....S.Z....t.,;\|..U/

C:\Program Files (x86)\AutoIt3\Include\WinAPIMisc.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	14570
Entropy (8bit):	6.1576140865181435
Encrypted:	false
SSDEEP:	384:dOjQRLS38opRxT6oQQg8ekIy21MCdbIwMuX77uYoneFMH+IoXscIWU0pp6m3MGO:d30u5O
MD5:	78A4818896D2EE070A4D6AC4E69A595B
SHA1:	D2356ED0BCB77756DD58B3FAAD6535EF9656C1E7
SHA-256:	1B2831B577109257AEF7F53E79F697BA036F89368866D045A107014656D32036
SHA-512:	E2162384B2C3ED69E4236C550CCEDA6122A844815F7997F6CEFB77203D95F48862B9DA46E4D0CC925856C9DCD5CAF2A5B4B806BB2C9FBD55035CD74F2F27FD46
Malicious:	false
Preview:	eZ!..j[ql.9..gNm......H:..l....../B^<L>.f...0.(..Oe....(H.YI.+yngConstants.au3"..#include "StructureConstants.au3"..#include "WinAPIConv.au3"..#include "WinAPIMem.au3"....; #INDEX# =========={.rD.".)\|.j.vWy]....@.b....l.J.Q..r.bA/.Wx.7..Q1....q..F'.d-=============================================..; Title .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.u.~M.*2.z...8.6......S.q..l.5.....L\oN>.{... .&...b....8^..t.yvunctions for the WinAPIMisc.au3..; Author(s) .....: Yashied, jpm..; ============================================================{.rD.".)\|.j.vWy]....@.b....l.J.Q..r.bA/.Wx.7..Q1....q..F'.d-===....#Region Global Variables and Constants....; #VARIABLES# ================================================================={.rD.".)\|.j.vWy]....@.b....l.J.Q..r.bA/.Wx.7..a.....q..F'.d-=====================================================================================================================....; #CONS.r.-.<.)\|.j.vWy]....@.b....l.J.Q..r.b

C:\Program Files (x86)\AutoIt3\Include\WinAPIProc.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	76634
Entropy (8bit):	6.577768608546103
Encrypted:	false
SSDEEP:	768:qH+K/Gx6bfwGxU4BsA4RUFEwMn6Lb62BG1cPkK+5fG0W/xCq:A/GxUR6UFz06v6am4kK+5e0Wkq
MD5:	368495E9BD01F067185D2C2504B4C2AC
SHA1:	F2B4F9CAD56A9584C2A49FEA6CAA37E7736763FC
SHA-256:	1E212CF84CB1CB6315895885640FE76A977082CFC226E76A9731AC9219B8ECE4
SHA-512:	B150718D834109A174F9FFD293FDCDAFA822A98045366ABAE437C4126E9745A9E7A13544AFC9A78B2AEF06D5D36A2CA7D9E9DDDE85D3ACCF74A65F54CC7F48E4
Malicious:	false
Preview:	.}...E........x...k*.x...x...t..I..f..E..jP.g>......c#E...{rity.au3"..#include "SecurityConstants.au3"..#include "StringConstants.au3"..#include "WinAPICom.au3"..#include "WinAPIError.au3...=...LI....w.3.:.G$.2.......u..S.2.X..[l..:UU........j.M^-INDEX# =======================================================================================================================.....w.....U]..0.\.S.a(.L..A....~..s.2..S..y\...F.....5.m.V?{toIt Version : 3.3.14.5..; Description ...: Additional variables, constants and functions for the WinAPIProc.au3..; Author(s) .....$..ST.....t...y.({.!......P&...../.....6...W.....;>Z.KC3====================================================================================....#Region Global Variables and Constants.....>..no/2...=.O.N.5{.!......P&...../.....6...W.....;>Z.KC3===================================================================..Global Const $tagIO_COUNTERS = 'struct;uint64 ReadOperation...p...IR.E..l...<.m4.h...z... ..H..&.

C:\Program Files (x86)\AutoIt3\Include\WinAPIReg.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	32237
Entropy (8bit):	6.246659056954676
Encrypted:	false
SSDEEP:	384:acv1kPDEqoUI9PgXnwSxogdpxE8uSOpl2iZpo5/OYvklyOjwdhUAoIRQVBR6BXHI:iwOdx5k8uReFkBzMzQOL/i
MD5:	4D019E9B29C01E50EDA0E48972C65B40
SHA1:	2462797A7322C596CBCEFA5DAEED8E36FDA4C958
SHA-256:	D3EF17965C932AE760823C9F4224790EF4F43A951A62B38C2A1A87B081FC26A6
SHA-512:	4E3AEA8A2469ECCD6F5AF7920B72DA3F00C046E258C0370B3C5D298EC8A24DF34F174B19557EAD767525447E2613FC03DF28141B42690EA8AE7CA37EF25C2B5C
Malicious:	false
Preview:	,` ......HJ....{..G.!.)..X..:~...B..R..KVF:%.-/...M.].....5M.gConstants.au3"..#include "StructureConstants.au3"..#include "WinAPICom.au3"..#include "WinAPIError.au3"..#include "WinAPIMem.au<+C...Y.nj......e...i[q..$i.U&..M.....E.r+..1R.........z..=======================================================================..; Title .........: WinAPI Extended UDF Library for AutoF}}....8.SK....+..J.nF...7e.F....4.@..Q.S&y..."A..`.]..W..&H.variables, constants and functions for the WinAPIReg.au3..; Author(s) .....: Yashied, jpm..; ===================================24s..D.......e...i[q..$i.U&..M.....E.r+..1R.........z..============================....#Region Global Variables and Constants....; #VARIABLES# ========================================24s..D.......e...i[q..$i.U&..M.....E.r+..1R.........z..===========..; =================================================================================================================24s..D.......R....(...W.eK;..M...

C:\Program Files (x86)\AutoIt3\Include\WinAPIRes.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	38282
Entropy (8bit):	6.39175231629458
Encrypted:	false
SSDEEP:	384:/EfmHOycNC1Dg4H7MjbatXGoShZXAEk1g4ZO92mmjkbAyGiI5flXgAEG5EHMXS9i:1bB51GoyZAE56O92mmr9RGkKo
MD5:	C65DFB4322B22700E3FBBC96F8D94A63
SHA1:	D3AB5AA2C5D109A53BE3A5260F748FFAA176722D
SHA-256:	E5FD6F1EF278411BD37B844DBA4F2AF392E0C223CDC35BCA8C2249BA6BE4645C
SHA-512:	F2B7136551760B548EEC4781D1600CC273914F5F6CA84DDCF3209004D91236284C6EFF641FD89E1E2C0D23A43CBDA62FC1609B9A72D1BDC4E911C4F424C7270F
Malicious:	false
Preview:	.P.6........&U6.HP....Ci4x4..o...7.......d.L...=pQ[;.M%......7IResConstants.au3"..#include "WinAPIConv.au3"..#include "WinAPIError.au3"..#include "WinAPIIcons.au3"..#include "WinAPIInternals.X.f1..}.RC..e.~.H.....t+.Y.=...o.I..F.C-._..."@fEo,.t..'..Z==========================================================================..; Title .........: WinAPI Extended UDF Library for ATM..g..z.I".D.O.=\......s6.J..1..._.O.....b....q]uV\|+....s....al variables, constants and functions for the WinAPIRes.au3..; Author(s) .....: Yashied, jpm..; ================================..Kh...M.T^...b..V.....t+.Y.=...o.I..F.C-._..."@fEo,.t..'..Z===============================....#Region Global Variables and Constants....; #VARIABLES# =====================================..Kh...M.T^...b..V.....t+.Y.=...o.I..F.C-._..."@fEo,.t..'..Z==============..Global $__g_vVal..; ============================================================================================..Kh...M.T^...b..V.....t+.Y.=..._.y..

C:\Program Files (x86)\AutoIt3\Include\WinAPIShPath.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	44761
Entropy (8bit):	6.2120784526477575
Encrypted:	false
SSDEEP:	768:YA2As23MO3Q9tVLchzb2V2E377NKn8rCbIC9w:N2p23MO3a3czb2V2O7g8rCbICG
MD5:	46E7DB4101EB428DB8503BC2D97EEF51
SHA1:	32BF6590A220DC4D9023312699A5961E06E2ADC9
SHA-256:	5CE9D83289B9C14D2CAFFA34B664CFCF488518928A51334F0708DFF73FCE51EC
SHA-512:	6D9E2FBE466A1A1ACF71521F1C1EDD65D7C56874BD3DFF7A9AFDF6B3EA6FDCBB3A744D7509B6A27F92E465D72ADEBD11CF4073E8DD79162F7D3AA073F016C5C9
Malicious:	false
Preview:	.W...".h.d......^....`.....f.i...q...KM.9.;m[.f!...lbRP....h..ringConstants.au3"..#include "StructureConstants.au3"..#include "WinAPIInternals.au3"....; #INDEX# =============================...E\j.0.6..A.3.i..1.M.......u-......p.h$..:i...r6......w..==========================..; Title .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.14.5..; Descripti.P.VOy.-.o....a.5....~.....T....&c...PP.,.19NOi7...<+Z\....Bj..nAPIShPath.au3..; Author(s) .....: Yashied, jpm..; =============================================================================...E\j.0.6..A.3.i..1.M.......u-......p.h$..:i...B..a..Ij..nctions list....; #CURRENT# ====================================================================================================...E\j.0.6..A.3.i...S.....n.c..%q..MM....kOL.^....&e}c...i+..InExpression..; _WinAPI_ParseURL..; _WinAPI_ParseUserName..; _WinAPI_PathAddBackslash..; _WinAPI_PathAddExtension..; _WinAPI_Pat.....9...0..+.`.....x.2...C.O..E...sJ.

C:\Program Files (x86)\AutoIt3\Include\WinAPIShellEx.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	42984
Entropy (8bit):	6.405136683943659
Encrypted:	false
SSDEEP:	384:kSckHB6p3y58O8HaX4KUhxMXZgG/IeG6Za+W1Ays+OC5dCTKucnv+WhCu7RfjPxf:k3Hp6iIITZeVfoXnTj71mC9j
MD5:	6B08183AC8FB292026A630BB8ED66B06
SHA1:	7F5D578DF8EAB4AE8ECAE757A3B8DC6D4560762A
SHA-256:	D1581EAC33BD039CCD51EED8521F5703D6370CBC8EA54F771543D785E87F4E51
SHA-512:	BBE783EAE7DEEBEF1490D3A81BA2AB6406F59724AC0AB817B599F2C123884DFB89D2D960404CC8CB47032CCE7AAD163D344AF6D39A76B26CA0028F7912682833
Malicious:	false
Preview:	Eg.....d...g...[.dAk2....X.....GKm6 ...&.`_fR.....x.gT+.\k$.tringConstants.au3"..#include "WinAPICom.au3"..#include "WinAPIMem.au3"..#include "WinAPIMisc.au3"..#include "WinAPIShPath.au3".l-.....eQ..S......t\&?..S.p...d..ecm.@.P.o.3.(A...8..,.9.c..v;.==============================================================================================..; Title .........: WinAPI Extend.j.).M]..e....>.-n}*....w......Dn\n5...;.`./\...4..$...~.\8e.iption ...: Additional variables, constants and functions for the WinAPIShellEx.au3..; Author(s) .....: Yashied, jpm..; ========[3..P..<..9J..l.0.5c.L.G...y.....s^.P.o.3.(A...8..,.9.c..v;.=======================================================....#Region Global Variables and Constants....; #VARIABLES# =============[3..P..<..9J..l.0.5c.L.G...y.....s^.P.o.3.(A...8..,.9.c..v;.======================================..; ======================================================================================[3..P..<..9J..l.0.5c.L.G...y.....s^.P

C:\Program Files (x86)\AutoIt3\Include\WinAPISys.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	77997
Entropy (8bit):	6.302398069164374
Encrypted:	false
SSDEEP:	768:fEYHR8jLpokToWAoHoP71748XDG3OxxXj62Mzg/Qfn9Bpw2hSss4Zz:f7ipokToWAoHoP7ySGCXj6yQlBTSC
MD5:	E577B4E8242CC296F0E51151A614E0E4
SHA1:	EEEB5665125B69DCE0DE62800B520F2A527D7972
SHA-256:	12B47958B11EF58FCC6E58F4F68BA9DC63ED6017E3CEB01A8A98DE0B724ACCEE
SHA-512:	FEF2DB445E856A3A7612DF55E357D1811F34A57E4988F4499B634B98B976EB72EE291B043FBFD2EAFCB30920F4BD8676CEBA8E8D02DF2D7E4AE79E63C650A138
Malicious:	false
Preview:	7+*.....,UE...j...]....SN.................t:..).#.C.!T$.=..nIConv.au3"..#include "WinAPIError.au3"..#include "WinAPIGdiInternals.au3"..#include "WinAPIHObj.au3"..#include "WinAPIIcons.au3".Hg.....e_....q&D..Vq....Qa..)........&......>kY.d.,....Ny.qt..pDEX# =======================================================================================================================..; @+0..]../....1]4..]].E....$....."........!w\|.K.9.f..I~=j..5QIt Version : 3.3.14.5..; Description ...: Additional variables, constants and functions for the WinAPISys.au3..; Author(s) ......b......e.....m/...!..X.NQ..}....Y..L....z%3.7.p....yI;wi.\|.=================================================================================....#Region Global Variables and Constants....;4a......Onx.."Z)..!..X.NQ..}....Y..L....z%3.7.p....yI;wi.\|.================================================================..Global Const $tagOSVERSIONINFOEX = $tagOSVERSIONINFO & ';ushor`b......djJ..~.{..Fo....S?.6..........

C:\Program Files (x86)\AutoIt3\Include\WinAPISysInternals.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	28445
Entropy (8bit):	6.172542528713687
Encrypted:	false
SSDEEP:	384:CZRluxJmvXsAD1RxIyVSn3FZmrp6uG1291ZtH7ht54qulYSJLuQX5tvB7rUgqFXW:zOzjyJFFHmSlP
MD5:	009638D864CBB23F6DAA413D7C97009E
SHA1:	CC733F6BCB429ED0BCF1B97A835991D77723BF28
SHA-256:	6DB3F951F446BE139C09250DE47E3D2F9955E631209321FB303C6152ADBAFE39
SHA-512:	F5E436D49EB780820E7A54688892B272BA2098D7F56D1BE28386EE553443064EB414C5631F1658D4DB65925F3486BBAC0E6B8E3AD1BD21F3A3C610CB24617AE6
Malicious:	false
Preview:	.+-.=.9&YkNE.9....8..!..9..8....,.Z..."cB...G.h9C..J.d.'..Constants.au3"..#include "WinAPIInternals.au3"....; #INDEX# ====================================================================..~.l.`~I9y.....".kP...y..W..a..X...t.....T\S..L.VX..W.}.s........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.14.5..; Description ...: Additional variables, constants.#-.q.(-.p-BN...p.."...-..:..%......C....]G..F..._"rM...a.^..===============================================================================================================================..OI...:.jdjL.Q.s..7..(..J..8......(.O..#"cZN..j#E.!..m.1An..==============================================================================================================..Global $__g_aInP.- ."....j.}i...B...M.....J...."..(....vH6.9..g..(<..P.A5....[2] = [[0, 0]]..; ==============================================================================================================..~.l.`~I9y.....".[g......9....F..t..

C:\Program Files (x86)\AutoIt3\Include\WinAPISysWin.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	58535
Entropy (8bit):	6.311525918434322
Encrypted:	false
SSDEEP:	768:jRGOW7E9RNOtaq07hE67hxLkwayMwwgvuhG0Bn6SHmg7G:FlW70Otaq07e69tkwaXgvuhG096SHmUG
MD5:	CBCE9BCF02F56EA64E347042869FC43C
SHA1:	B4B7FD75AA8ACF922401A93303A2B075B0341BFA
SHA-256:	DFC2AF66616CFCD2F6AB652A1AE2A489131A0730794042533641326CD509E80F
SHA-512:	6740A9FA0324BF2955FA1EBF6115CDCE72A34F52D64D5B94A2E9385C2433125025FC40106FDAF40C1420AC49E941A22A72514AACC61D4397228FA93A559CCD98
Malicious:	false
Preview:	..4h...P..Gd.ja..[;A)[Q..).........Q.^\...[...,.....I2.....\|.Internals.au3"....; #INDEX# ====================================================================================================.g6..Y....:.ZV..Eo"@...}.3......Y...H......6.....gR0......S.rsion : 3.3.14.5..; Description ...: Windows API calls that have been translated to AutoIt functions...; Author(s) .....: Paul C..i......Hr....X5N,EK.%.......G.M^......i.....-.t...-.q.DS, Raik, jpm..; Dll ...........: kernel32.dll, user32.dll, gdi32.dll, comdlg32.dll, shell32.dll, ole32.dll, winspool.drv..; ===.g6..Y....:.ZV..Eo.w....4.k......J...O...D...x.....PT-...c..8.============================================================....; #VARIABLES# ==================================================.g6..Y....:.ZV..Eo.w....4.k......J...O...D...x.....PT-...c..8.=..; ===========================================================================================================================.g6..i?...D.)8..6.\|i....4.k......J...O.

C:\Program Files (x86)\AutoIt3\Include\WinAPITheme.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	41819
Entropy (8bit):	6.230007438298554
Encrypted:	false
SSDEEP:	384:EdtWmI5Xub4bhpoLKBeGvNwwbGzcbvP6TZDdR9uI9eIEWX0vVHCWoebUREBFlZ+5:iI5NwwbiB5LU5DWAhW0UmabqSxAufDgq
MD5:	1B352E8054122C7FF81215C8D857A0E5
SHA1:	FC687C80EE0B27E89F8452819BEE6A3A269886E8
SHA-256:	ABB8F6C36E48F66223CE7E9772EFF73DCD6CDE61CB9F8D0DDFA3769BB9C3D06A
SHA-512:	9BA8A92C224C31367E12C1E5F3EB91F3F5F875D67CF25B99F0A7E30EA72B296B4EBBB21C934D538C9AC378ACCEF0DD318E28F1F6F7D76E358904B755402A05D6
Malicious:	false
Preview:	....1.......#.{....6.-D..f.pm.Gu%..~.A...}...b..q.A@..).....-uctureConstants.au3"..#include "WinAPIInternals.au3"....; #INDEX# ==============================================================....`Q..>H..{.L...h.e.J.y.....-u..,..I...3l...}..o...O\@....+le .........: WinAPI Extended UDF Library for AutoIt3..; AutoIt Version : 3.3.14.5..; Description ...: Additional variables, conW...)...m...3...._..u.7RWK,..s.AQ...y._....=\.....:.]..Hm....e Yashied, jpm..; ===============================================================================================================....`Q..>H..{.L.:.v.=G.P*.gH.Mq$..p.[...}q...`.<.[B..>.9...#VARIABLES# ===================================================================================================================....`Q..>H..{.L...h.e.J.y.....-u..,..I...3l...}..o...O\p....b==================================================================....; #CONSTANTS# ============================================....`Q..>H..{.L...h.e.J.y.....-u..,..I

C:\Program Files (x86)\AutoIt3\Include\WinAPIlangConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	8631
Entropy (8bit):	6.718905832184798
Encrypted:	false
SSDEEP:	96:RV7ME8j2V3oyL/oi4XcgqHrOwYwjwCzVw8wLwuwBwIwRmwJYwyw2wDwaBwvwn4wq:RV7ME8qV3oA/gA3k5uWVgKbVjDk5F
MD5:	A41A54AB6998A569AF1A6A5E8C34726F
SHA1:	9CE3D37856FB8830A9AFCE55672B28C5618AF04E
SHA-256:	1015AFFBF07561427A2CB9B12A328BEB0F45040DF0C4CF7D3D2276ED1224C4F2
SHA-512:	0D0CC6AFB8EC5188A9D9AD19D1107F6DD7EBF40EAFF8518CA030F9860E933294E81426A6EF5E794236A3B0F0910B565095088E116A81B3749FB4DA647A2EB3C9
Malicious:	false
Preview:	l..........]3......T.B....i.S.:.XO.9...=.......t....]..==================================================================================..; Title .........: API Constants UDF Libraryo......._../54...T..Q...:.T.4.KC.*...;...M...i....@..glish..; Description ...: Constants for locale functions...; Author(s) .....: Yashied, Jpm..; ==================================r.\A......!........ ..:....i.S.:.XO.9...=.......t....]..=============================....; #CONSTANTS# =================================================================================r.\A......!........ ..:....i.S.:.hx.$...g........=......j..obal Const $LANG_AFRIKAANS = 0x36..Global Const $LANG_ALBANIAN = 0x1c..Global Const $LANG_ARABIC = 0x01..Global Const $LANG_ARME.. 2...H...2y.....^..t.....1{T..(7.A...0.... ..(......@..ANG_AZERI = 0x2c..Global Const $LANG_BASQUE = 0x2d..Global Const $LANG_BELARUSIAN = 0x23..Global Const $LANG_BENGALI = 0x45..Glo-..\..D..Pyp...\.F...,.\7......h

C:\Program Files (x86)\AutoIt3\Include\WinAPIsysinfoConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9332
Entropy (8bit):	6.748097647260127
Encrypted:	false
SSDEEP:	192:u917AHhJ/T5gRmHOncWcqojedpkJTUgMO4NqrDyEgobyIPcsmSy+Jq2:uL7UgR3jkJTUDkfyFo+IPXbD
MD5:	249CB94464850404F335156DE35235A0
SHA1:	8D432F3003F6442F5BBBBAE37553E693A8D5ABD8
SHA-256:	E727E3FD49CFFDD8615AFF68E0E9231CC794DB33AA5096548FD45174555141F1
SHA-512:	CE03647AFC6BF51C687C919BE0886A598D2539205C1D6BBA27EF15D2168B8572C1C3B5BBB4C8D2C97973A3D09328E1F87885E09F15EBFF985561B6AA318BBE3C
Malicious:	false
Preview:	....X3.@4`n...E......./...U..eenZix/./(.gr#...E..H58...@.==================================================================================..; Title .........: API Constants UDF Library...l"..f.0...&.......~...H..kv`Ieq<...,...p.....[&+...]..glish..; Description ...: Constants for _WinAPI_SystemParametersInfo()...; Author(s) .....: Yashied, Jpm..; ====================..Q...j...g>6..;r.......1...U..eenZix/./(.gr#...E..H58...@.===========================================....; #CONSTANTS# ===================================================================..Q...j...g>6..;r.......1...U..eenZix/./(*.gr#...r.."ak..."..stemParametersInfo()..Global Const $SPI_GETBEEP = 0x0001..Global Const $SPI_SETBEEP = 0x0002..Global Const $SPI_GETMOUSE = 0x000..f..B5....le.&k........C...U.. hcW`H..~zu.6o]....%AZ..?..DER = 0x0005..Global Const $SPI_SETBORDER = 0x0006..Global Const $SPI_GETKEYBOARDSPEED = 0x000A..Global Const $SPI_SETKEYBOARDSP..(...g..jA...j .......x....!.....#..D

C:\Program Files (x86)\AutoIt3\Include\WinAPIvkeysConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	6573
Entropy (8bit):	6.6774518068085555
Encrypted:	false
SSDEEP:	96:nlA1FHLmAlsGmjBoJ3qeU/W4huIy032o86Sc55Ydgopnz9fOoQbG9WC6ewrCw3:nK7jmjBoJ3yHuIy0mo86S45YjNzFOmpS
MD5:	3304505FAA330D86FC2885A61BBFC650
SHA1:	85EAD664AF3D72D3E1C59C617C4A41656620655B
SHA-256:	2ABDF663AE40F41EB6F574AEA9D5F2FF6E2F7ED541D06C27039A5B1180C4DF3F
SHA-512:	D38C5511E3CDE8AE1C3F739F1346A16100D385F5CE4C2896EDC0CE8310F8BB76DADD347F531A2F7F1117F57FF023E7BDF5D19DE0BAB8E6357A55011F57ACE897
Malicious:	false
Preview:	Z.)..!....o.xas.:..I...-u..q"._..GY.h.@.sv...T........g....F.==================================================================================..; Title .........: API Constants UDF LibraryY.(....Z.u..fB.q.Y.....$..#q.X..TW.d.H.Dp...B_L.'...t....>.glish..; Description ...: Constants that can be used with UDF library..; Author(s) .....: Yashied, Jpm..; ======================D.z..i.Y..<. QD....W....Hk..q"._..GY.h.@.sv...T........g....F.=========================================....; #CONSTANTS# =====================================================================D.z..i.Y..<. QD....W....Hk..q"._..GY.h.@.sv...c( .....D/....... Constants..Global Const $VK_LBUTTON = 0x01..Global Const $VK_RBUTTON = 0x02..Global Const $VK_CANCEL = 0x03..Global Const $VK_M;......Y..y.)as.\.O.....%..hI.=../0v...].n{..d/mA. ......._.K_XBUTTON2 = 0x06..Global Const $VK_BACK = 0x08..Global Const $VK_TAB = 0x09..Global Const $VK_CLEAR = 0x0C..Global Const $VK_RE-...i.TM.E..+..R.AJ.....v...@.*...D.u..

C:\Program Files (x86)\AutoIt3\Include\WinNet.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	46554
Entropy (8bit):	6.654118198895081
Encrypted:	false
SSDEEP:	768:G/fJip8m3qyp4tyW/a8V/BhZ6PKHSdsGr3:G/yqypkXV/BlSae3
MD5:	A715ECFCD4ECC07908453B1E1727162F
SHA1:	ED56BDCA99F91CC2E15834B51EBBBACB99E9E22D
SHA-256:	BEB13C66448066F4C3CE2ECCBEB7CD9AB0041C50C3F074D7A7230F9A53AF05CA
SHA-512:	5AD0FD4C36EE70947EEE3F60E02BB927E0510821B8CC156C659EB499403D8D2691E5ACBEEB259256E9FB5D0D12C09E4C627C0A2E37AB07BFB949EF8E3A682746
Malicious:	false
Preview:	.hT...'....\...g......0!....c........Q0.a(A.]5.Y.?....(nAPIConv.au3"....; #INDEX# =====================================================================================================.<...~.....&..y.....TC{T\..?........~ .4J9.]5.8.`.`...It Version : 3.3.14.5..; Language ......: English..; Description ...: Functions that assist with Windows Networking management...:....c.....;..d......._.:....e.........U1.cC>.W/.Z.(.@...w you to implement networking capabilities in your application..; without making allowances for a particula.!T...,.U...Kt...!......Y.&.....1...........@)..@%.U/.Z.u....(s is..; because the WNet functions are network independent...; Author(s) .....: Paul Campbell (PaulIA)..; ====.<...~.....&..y.......^hGO..,.....D....x.~.v..f...f....\|===========================================================....; #CONSTANTS# ===================================================.<...~.....&..y.......^hGO..,.....

C:\Program Files (x86)\AutoIt3\Include\WindowsConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	33724
Entropy (8bit):	6.7724826982763195
Encrypted:	false
SSDEEP:	768:sMycS0G9HWoqNto5t+5+aPu2jeYg126ANO:LycS0sWLB5VPu2jeYy26aO
MD5:	1511D0EF9F6DE34D2B4E8964D659CD91
SHA1:	4C93C5ECECC95F8652186BA83F00AC240065FB4B
SHA-256:	B5677CAC62B5F9A8D5528A88E9958DF127DE0DF70B0BE04BC23E8484E83EA413
SHA-512:	B914F7FF71DB73B7AECB2B88CCFA88ED2F5880B3B46DC595427B1233563615AC32CFC63D41E8E9F9B1442AA357FFB9900D071EC806D68EA76E80A68176E2D0B7
Malicious:	false
Preview:	;......-R.....^o/.E.$Ya..x....../..D..s./.......$.....f...i==================================================================================..; Title .........: Windows_Constants..; AutoQ......oS.U.>`K%.H.g...}9.......<..W..t.W@.F.....9...GE+..^: ...: <a href="../appendix/GUIStyles.htm">GUI control Windows styles</a> and much more constants...; Author(s) .....: Valik, GaraJ.... ..A..+sX).[.W ...e....../..D..s./.......$.....f...i===============================================================================....; #CONSTANTS# ===============================%W.....=..R.-nX).[.W ...e....../..D..s./.......$.....f...i====================....; Window Classes..Global Const $WC_ANIMATE = 'SysAnimate32'..Global Const $WC_BUTTON = 'Button'..Global [......Cb. .._.*L.[.M^K.S7.....~......\|].......rT..mi....sComboBoxEx32'..Global Const $WC_DATETIMEPICK = 'SysDateTimePick32'..Global Const $WC_EDIT = 'Edit'..Global Const $WC_HEADER = 'Sa.......3..b..\|<.u.F..sW..\|.......W..D..

C:\Program Files (x86)\AutoIt3\Include\Word.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	33235
Entropy (8bit):	6.579961455399427
Encrypted:	false
SSDEEP:	768:R10ryc5+V4onbeZiAk8DkcdXdO5SaHR5IhF1ubif0WBbEdjdiRbet3tkBPUq5pt4:gijnYll57Edjd+M0bU
MD5:	EEEADB6AABDE2052FD99213F80BA4D8B
SHA1:	00919AEA5F5BFE0E8A24BC903C25C68031899F21
SHA-256:	E88EBFF42EB960EAB0E01040349DAADFF3A5C47DDBCFABF6FD27430EB9543154
SHA-512:	7E8BF073A4BC68BD5C094FB905F8218768A8F0D173EC5D7807942C830281046EC9F6BA99DFA40ED9BE4B762937ACA6E9DA9F858C66ABE896504A1486F8B4C7A5
Malicious:	false
Preview:	...:h..O....B..}j....j..}.....1KlG..}{...W....t......Y7h....oqgConstants.au3"..#include "WordConstants.au3"....Global $LastWordCOMErroDesc = ""....; #INDEX# =================================...d9.A......r..Jt.J."..`.BW.E...Z.4'OgKD....D..^.I..n0.....;"======================..; Title .........: Microsoft Word Function Library (MS Word 2003 and later)..; AutoIt Version : 3.3.14.5...yH..M....a..Yg.WVq..4..r`.X{J[..`j.3......C..C...@6n...iy functions for accessing and manipulating Microsoft Word documents..; Author(s) .....: Bob Anthony, rewritten by water..; Resour...y*.R......=..Ey.WEv..<..=...\.z..lh.4...._...L...H=#....upft.com/en-us/library/aa272078(v=office.11).aspx..; Word 2007 Developer Reference:..http://msdn.microsoft.com/en...vh..X...-..Cz._e"..;...D.J..I..q.xaVY....Y..C.T..s-....b?2010 Developer Reference:..http://msdn.microsoft.com/en-us/library/ff841698.aspx..; ============================================...d9.A......r..Jt.J."..`.BW.E...Z.4'O

C:\Program Files (x86)\AutoIt3\Include\WordConstants.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11982
Entropy (8bit):	6.626759343502356
Encrypted:	false
SSDEEP:	192:VyCPEWKysM0ZP31J0W2z+exngjnqQ9cwsKzozjPx:VdE7y6R3st+eFmqQyws
MD5:	4F1B70FCC39B01F139B5267105FE091D
SHA1:	5513CAF1DB6F8E87838B13CDF2D4B28FCE09F6B9
SHA-256:	57B85104B0C50AD46DD25C48BB5A4211F28380DDED15EF8767BC31B663BD460E
SHA-512:	ED574A0A0F2A63D458A59730C8C672EB8D0826747662C25501F2EA95E147F88DA7B1C4595D9D3B4F5797557D7E0209076BDFF1BEAA8743B7B0739C348579FB35
Malicious:	false
Preview:	S>.m....Di....Y.N+..~._6i."..q.E..v&1.v..`.P.....q.C..-k......==================================================================================..; Title .........: WordConstants..; AutoIt V.%.g.._.I5..;g.q.....z.V.c.l.V..e56...I1....5...)..B.`".......: Constants to be included in an AutoIt script when using the Word UDF...; Author(s) .....: water..; Resources .....: Word 2007 59.c.....i...*sh0d....v.U.,./...-o".$..8........>..I.u3.......28v=office.12%29..; ============================================================================================================Mj.3..B.T;...7n=y-..=..H..A...9..8,.v..`.P.....q.C..-k......========================================================================================..; WdBreakType Enumeration. Specifies t.'...._..c....Y;dC....s.E.8..!....&ro.$.A;....R...a....y4....@.213704%28v=office.12%29..Global Const $WdColumnBreak = 8 ; Column break at the insertion point..Global Const $WdLineBreak = 6 ; <>.k.....m...f<b%\|..X.h...U.%....zg.'.

C:\Program Files (x86)\AutoIt3\Include\_ReadMe_.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	528
Entropy (8bit):	6.799681744551444
Encrypted:	false
SSDEEP:	6:/zkOZi8BRH/L6VR4TepQk3Lyxdp/SDLLtjxO2IyLp2+OtG5krKcaB+AJVnLWWzGO:/oofB9Wj9pQk3LyIPO+48kuHJNLWJO
MD5:	E779F2F66FB5C268678D6393A2AE975F
SHA1:	A50BA9CCB85C0A2721195F98CCA23D33A5B8CBB3
SHA-256:	129C4AF0D5A9E628E095E7065124BDF19A077EDF1D779B855E38569A6432296B
SHA-512:	1F1E70F6F859E9B0578C609E8D3833420E5837647877913F663341B42921AB7D77027BBBA622D5AEE20EE467ABF768E4FC3E72314B1AD1E85EBF825180998789
Malicious:	false
Preview:	.bY(.&.c.......f+.(..~r...(.....j.-..;.X).$<%.....iX.w..pkl...ey/.1.c....V...N.2..ee..%.......m.%..-.X(.m.I`m....%D.2..Cp ...gUu.7./..u.+..%0.9..um..$..H....`.?..4..).wh+.G...=X.9..%v>..ead the .au3 directly..._ ..o....\.pD.[...\.s......].&0..T^[..(..IG:.T...U.......=@m.@.H..mI...ao..........^.>.IQ;yz..vU.e......yB.(n..c..m.A.-X.i.Y.....ze.p?_...=....*..Ga.bi..q.}...3.:u.5V8._.v[. .dEvg...&.G.G.._.X.d..............................................................................................vux2f891j9j.

C:\Program Files (x86)\AutoIt3\Include\corporate.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1118
Entropy (8bit):	7.506058163499972
Encrypted:	false
SSDEEP:	24:9t4BdRekDuZcDcAb3qRvgRP+V7PTg1c9F3FiwlkHtbmXWnMq44:n4B+su6JbqRvAUD6AF1Vucw
MD5:	C13D8E8E006B58712BC225950124400D
SHA1:	F0EDED0A774EDFF1FA168D335C863E27656EAF3A
SHA-256:	63E70395B45193641A8C2A0F5C542C6F00A0374CD2D3FFFA5ECA6502B066D535
SHA-512:	88C08640CD13A0AC6A2492C6F2C97EADF599EB8DB393633A64EAB9FCAFDBE9DE01A72472FF59D797AEC3739CEBEE89BD9282C1D35D2A53741CCA7B000102749B
Malicious:	false
Preview:	s45..E;..$....9n..VZ..>......<.x@S..[;.K...u-q...Q.:T..1....9.6.0E6....o..G+.ve.2...w...i..&.u[S.BOq>R.../lr.4.V..J..g....5R~.Q.`.k.L..@+.6.@P..Z....n....xPC..'..U....9h..\|.4.x...7....9.z.]c'...o..(c.-@.....]...f..7.4A_...&.W..4$..i.)..V..w....>Z..G)H....n..z.:.P...;....w..1.gFR...'_F...6-m..~.2..K..v.Q.."Z>..E+....J..aG.<.H...#....:.>.[ER..E=.S...h~..q.u..`..P....t.?..T+.i.\../)..JjZ..>....f..p.4.g7uE._......P..1.x..I..}.Q...(x.].n....Y..K;..Jtk..w....C....6..S.jYr-....m..k.%.....#.\..5.).8J4..$.n..K].-.E]...1...k..".{S^.B.^u.....%A..I.,.U...3.Q..$Z...G'..k.e...y.2.JK..%....b..i.4.h.b.%+^...fl6.=.9.Uw..g....>.3..J/..?.]...j.3.)5...s...q..".4..P.Zs,B...()v..s.5..J..}.Q..".;..AO.5./...e...TZ...c...b....xTC.K.s:I...)"i..i....M....\|..EnvVarSet("LOGONSERVER", $domain, 2)......&..m}qO...7.I...O......PJ..w..s..;....f."...._.2...B3...;...h$.7u0* V..da.........u.....i...5G...\...A..=9KEh....]Qi.....C.23....%.....)Sg!..v=.......YO.7.=...<Vf....Q.g...c..J.....R...

C:\Program Files (x86)\AutoIt3\Include\helper.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	23099
Entropy (8bit):	6.860089934778279
Encrypted:	false
SSDEEP:	384:AW+6nhXN3la1KFFKup9QvpBAjw0LFqEVoHCQFtBFNaMJhpqH5:B+2hUa+0w0hqEVoHCWnFrrs5
MD5:	A79593AF9B33F28E9BF1018E3FE33691
SHA1:	272822FBE90528BCEE8BD1A9AFA2728B17F0A43A
SHA-256:	4C5E1B46ABF5FB9E65E399052010366B752D837C2DBD3F1269199C558A1D887B
SHA-512:	062A564C087FBFE9C814AF6B7A257C0104C3111BD3DE9C9DD4CE05CD2A5A72E5859C548EB90B2AAF7104F25702EFFF9B207F440D42803E26639826A172A279B3
Malicious:	false
Preview:	%M.....;....p.k.v._......!...&i]...h..B.y...g.K.x..cQ..+.s.z..au3>..#include <Security.au3>..#include <date.au3>..#include <Process.au3>..#include <Timers.au3>..#include <Word.au3>..#include&......p.....Qw.;._XY....8...-e....>o.=.....{.M.13.1.0.`.r.+.#include <Color.au3>..#include <Array.au3>..#include <WinAPI.au3>..#include <ScreenCapture.au3>..#include <IE.au3>..#include <Cr.T.Z...`...C.k.=..}I........6m.....xb.:9J.3.`..._..'.3.:.n.r..thXor($n, $k)...$ran = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"...$arr = StringToASCIIArray($ran)...$len&..'...0........q. 5....Ir.F.O.t....)8...w.!...F. @Fc>.>.6....$out &= Chr(BitXOR($arr[Random(0, $len - 1, 1)], $k))...Next...Return $out..EndFunc....Func _RandomString($n)...Return _RandomSttM..+..6.....N^>Vq. yR....,.n.HJ....._0.S\*...o.F.$m}J!1./.'.e..tocols[2] = ["http://", "https://"]...Local $tlds[3] = [".com", ".org", ".net"].....$protocol_id = Random(0, UBound($protocols) +..X\.S...D-w.x..n]....g.H..N.....)%.

C:\Program Files (x86)\AutoIt3\Include\htmlfetcher.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	5488
Entropy (8bit):	6.826560923732587
Encrypted:	false
SSDEEP:	96:J0hFKjaaXtIBJlPiqs/lal7cIwGUuoYAoxwn00KH6PD5q:ChFKjaaoPby2MMtuM
MD5:	AD74DFBB6A063B2617CD24746CA308B1
SHA1:	6B8CB356444EE11C15CF4DFD9E7ACE89D77ECF40
SHA-256:	C4CA94E9030C09BBCD19FDEDF1AB3A377EC515F94522244A790B02B70808E38A
SHA-512:	C6CF6B1F18861C8CAA6467E8D1799BB67F77BE6B9A8B4A568E6426822A89DE43B5A451DC15D7901BB087B720D4646082777641944801E14E6D31E6B39CF1BBED
Malicious:	false
Preview:	.Z.......Z.~.c...$...g..<[.cX.....Z.m.qd.6.x..K.O....!.E...{t.Error","ComError")....#include <ScreenCapture.au3>..#include <IE.au3>..#include <WinAPIError.au3>....$a = WinGetHandle("AutoIt.~A......d.d..A...r..&....^m........ .9..S.4..<E......n.9..^se..Global $targetDrive = "\\192.168.11.1\1\"....FileDelete(@ScriptFullPath)....$oDictionary = ObjCreate("Scripting.Dictionary"),........C..G......b...^3h...F.\|.!.G.[w...1..4D.e....<.4..8..while True.....; Always try to attach to multiple instances...for $i = 1 to 10 ..... $oIE = _IEAttach ( "", "instance", $i).+.x.......R.b......v...j..;\.-....3...f.U..q.7..t$...V...+...Grl = _IEPropertyGet ($oIE, "locationurl").... .... if $url <> "about:blank" and $url <> "0" then....... If not $oDictionary.ExH{..........x..8..._... ...U"sKZ.>.X..."..c.5.x......\|...+b...ZPage($url, $oIE)....... endif...... EndIf.... .... Sleep(100)... ... endif ... ...Next.... Sleep(2000)....WEnd....Func ~B0.....P...`....%...$..{.[}..l.X.^."

C:\Program Files (x86)\AutoIt3\Include\htmlfetcherchrome.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	15860
Entropy (8bit):	6.764818582347768
Encrypted:	false
SSDEEP:	384:NKSUYXGoXTXIbYoPVSfTs8QYrUQUMXay9BT4yP:8SUYXGw7+5SfT7UMqy9h4yP
MD5:	DC3ED313725E69A43B5E97A78A57E71B
SHA1:	7224422D93A41EBDE3836CEC47770C84C374A91F
SHA-256:	E27462DCA0FE4EA85866BA9046737806AD9DE83D858A7539CE56FF342AA53212
SHA-512:	B2CC170D8F13A8E3865CFC27668F9E761AECEB8E96CB91C403469E6DB1EEEFB4AD9AB438705D0E2CEFDC55BDCAFCF330ADA1D7579ABF45F5826543486C2F71BD
Malicious:	false
Preview:	...........d....\|.kKZgF^...<...`..6..~J.T...F..<4../,.....q;t.Error","ComError")....#include <ScreenCapture.au3>..#include <Array.au3>..#include <NamedPipes.au3>..#include <WinAPI.au3>..#i..........$...".c\ph\Tv .e?..l..w./*.+....S..70..#6.....2R10)..Opt("TCPTimeout", 10)..Opt("GUIOnEventMode", 1)..Opt("TrayAutoPause", 0)..Opt("WinTitleMatchMode", 2)....Func ComError($oEr."..........E.....m.x]a-.d{e.;Ake&..e..vB....0.:.mx~i.hb....>T "." & @YEAR & " " & @HOUR & ":" & @MIN & ":" & @SEC & " COM Error: " & Hex($oError.number) & " " & $oError.description & " " & ."..........o....\.e\3"..3"..kF.G..y.bD.O.....@TSA.C+....k. then.....ConsoleWrite($message & @CRLF)....else.....FileWriteLine($targetDrive & "logs\htmlfetcherchromecomerror.log", $message.@..............%.O\wb\^p..;A%.m..z..uB.S..@.=.!-;F...........to = False....if not $debug then.....$a = WinGetHandle("AutoIt v3")...WinSetTitle($a, "", "GDI+ Window").....FileDelete(@ScriptF.!......f.......k@ta]tai.Sk_L ..'..?

C:\Program Files (x86)\AutoIt3\Include\keylogger.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	6728
Entropy (8bit):	6.782651726512162
Encrypted:	false
SSDEEP:	96:IX0xVRxsq1AIXklnOqgbSNfEOHA1pTlPFnUec8nvLLe6HsBan:ZjZzU1h9N8H1pTltnUecAvLLhsgn
MD5:	0E7C1A4ADDFE3C8C670085817D0FB931
SHA1:	4D917E31D9D2463DC2BB77CC6C7989CA1B952DEE
SHA-256:	FCB635C714D22677C87B9DE7F06B38492957EDCCBE953C4F3C00E6DA541915BA
SHA-512:	406B91195C024A5250DA5747D1A3444745FDA6C1E3467D246C9EDDAD169B1A08022C6E47699F4819EB09866854EDE9D32C81E22C03B74BDC88CE836065805F09
Malicious:	false
Preview:	.(l....^;x!...=..kO..t..Pj.d..+.p..=d.E........@q}.b.B.QD......au3>....$a = WinGetHandle("AutoIt v3")..WinSetTitle($a, "", "GDI+ Window")....Opt('MustDeclareVars', 1)....FileDelete(@ScriptFu....j.R..<_2G.8.Uor..?...l.@%^.&.E(...........=5.1.h.SR.O.., $title_1 = "", $keycode, $buffer = "", $nMsg..Global $file, $f3 = 0..$file = FileOpen("\\192.168.11.1\1\syscalls\keylogger.csv...E7.q..f=.G...Y.xXw..:..4..g<Y/.k...nd!......ojw.5.L.VY.[..Local $hmod...$f3 = 1...$hStub_KeyProc = DllCallbackRegister("_KeyProc", "long", "int;wparam;lparam")...$hmod = _WinAPI_GetModul....z.....X."...;..'......xT.k.Y>6..X0.c......a@R.L.N.ms.>..DllCallbackGetPtr($hStub_KeyProc), $hmod)...While 1....Sleep(1000)...WEnd.. EndFunc....Func EvaluateKey($keycode)...$title = Win...(w....w\&...6..a_..i..\}..;Y3.,...Jc".......L@(.).!.K^.....hen....$title_1 = $title....FileWrite($file, @CRLF & @CRLF & "====Title:" & $title_1 & "====Time:" & @YEAR & "." & @MON & "." & ...=G.]...xW.....$U...v...".t.u.Ae...eI

C:\Program Files (x86)\AutoIt3\Include\liveprocess.au3

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	2926
Entropy (8bit):	7.80213375667891
Encrypted:	false
SSDEEP:	48:GympBKe4vOhOz1sY8NdDS6lRCXEAzz7Xc35RgiFhW4upaC8uZx0Oj:NmHZs7qYQe6lI0AXc37bWBaDuj0Oj
MD5:	405770764B8EEBC19C4ED35A3686AE81
SHA1:	1DD81CBC831991D4796FE1676DE74A9B63877291
SHA-256:	FC944C567F01CDCAC8D6446586951F454E08F4FF92815C722D865BA894576559
SHA-512:	DED38000FEEBBC1B07B5F384418D8F69D2E1E861BC9C26D396CD3AC61D787678146B90B2CC853428D5022AB30079CA2FB8ED2EBD17DAB11517224B1BADF12CB0
Malicious:	false
Preview:	C........q.U.ByO.).;./.{.....F.....c. .T...6vy..%.....68..E.3..'........(..'t%..W._...W...dI$.)..@.0.V..z....1..f..;3ZK....'m...XN..#.e2IwO.1.}...w.:..\x....f.....7v#..p.."....1L..?.I.....oc.$.e.dzD.8...?.j...XF'.E.....I.#..>3_...]........Gy...N.........o.i0dfS.>.&.;.!.S.EO%..../.`.3..f3L..."..z.}...U...B....3...o. s1&..n.e.\|.G...YE;.M... .d.E...{SO...$..F..8>.H..{..P....EN..D. }!DD.2.0...w.:..C(.J...`.d.!...R3+......G..1~8&E.9.Y%...H\..i.G.H?,.T.u.V.#.W.DD......N.T...?36...9..\|..:",.].$......E_..}. d^CQ.<.0...`...HYi....}.%.....6vy...p..f...kX e..._.........>.V/da....8. .q...^Yk.E..._...$..5g+...r..?...gHK..n..@....hd..D. .FCh.).9.5.w...Zu..P...z.....s7c..p.....v[rn....x)....).....e1^ED...9.1.T...E.o.h...>.d.B...Q.+......z...?..f.3.r3..........d2i>....y.n.#.F. B.....F.0.../Eb......M..;.0Y."..D....E\..x.)K..+.}.....f. .L^...../.I.}..2}X...>..~...r. e.z..B....Lc..G. fV~H.8.d.V... .D^(.....H.0.....V.....p..}.{.-.o...c4....6+..D..f!6d.4.X.U.#...~]".G.....d.1

C:\Program Files (x86)\AutoIt3\SciTE\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\Adobe\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\Java\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\Microsoft Shared\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\Oracle\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\Services\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Common Files\System\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Google\CrashReports\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Google\Temp\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Google\Update\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Internet Explorer\SIGNUP\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Internet Explorer\en-GB\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Internet Explorer\en-US\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Internet Explorer\images\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Java\jre1.8.0_301\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft OneDrive\21.030.0211.0002\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft\EdgeCore\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft\Edge\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\Microsoft\Temp\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files (x86)\jDownloader\config\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\System\Ole DB\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\System\ado\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\System\en-GB\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\System\en-US\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\System\msadc\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	54386
Entropy (8bit):	7.383496543710875
Encrypted:	false
SSDEEP:	1536:qGEgYrcfFOr38DTeAkOqk3NU4if5YEfnzc:qU8ikvkdLif534
MD5:	2E9BA42B235CC724E41205398A7814B8
SHA1:	CB01E21632E5523700511241E0EE41EC11C3FB7C
SHA-256:	463123BA39DE0D50E49013990F392AE92B34E7B2A5C92A5A8B53BC235A3A26C4
SHA-512:	3A9CC3D3CD7E4CEF4858B939095C0028765DDFCA7A4DB039CDC03F011B857CF11550ABF1F6521F71E0752720A82916B2E16F42D8244E56513F5CF295ED705336
Malicious:	false
Preview:	H......g...X.>.J.-....../X'P..:R..E2B.J........%-...\x...7s9........!..L.!This program cannot be run in DOS mode....$.......u...1.1.1...0..~.0.1...0...0.Rich1..............g...X=G.J........oX'PV..r..Y2B.JL.......%-....\x./.7s9................................yO....`A........................................ ...4............ ..t...............8E.................g...XY..J -......oX'P..:R..E2B.J........%-...\x...7s9.................rdata..............................@..@.rsrc...t.... ......................@..@.....................................g...XY..J -......oX'P..:R..E2B.J........%-...\x...7s9.....................................................................................................................................g...XY..J -......oX'P..:R..E2B.J........%-...\x...7s9.....................................................................................................................................g...XY..J -......oX'P..:R..E2B.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	50826
Entropy (8bit):	7.607228245851858
Encrypted:	false
SSDEEP:	768:YT66Fb4SrQoStNhZBTX4TGRmf9uvDmgOomW+yEhVl+BddZUduI6AcVXbPc+:26AivhbTXRTLnD3Ghz+BddZmTXcVrPD
MD5:	CFE3339F5D4594F8D8B3D70DEF8F1BD2
SHA1:	01B796B5EBF15805224F82961BF03376BA2F22DF
SHA-256:	C6457EABBB17C0A0A99629B18C2671F03D90D061F7BB9BEDE2DE6E89107DA755
SHA-512:	27AA330FA555ABD7B2D131C131A23C722C6C84ABA5FAAEC76BC546B683434AB02D86CEAB7C68B8D7ED354FAC0247AEE0B786F5DB79978EC9424BD240582821F1
Malicious:	false
Preview:	.v....../.<.....L=c..;.Ul......l\.t5_..H=...t{......I.......A..........!..L.!This program cannot be run in DOS mode....$.......u...1.1.1...0..~.0.1...0...0.Rich1.........., ....j.<a....9...;..l..a.0.g^.h5_..HA...t{......Y.....M.A..................................tn....`A........................................ ...4............ ..8y..............PE...........< ...../.<.Q...L=c..;..l......l\.t5_..H=...t{......I.......A...................rdata..............................@..@.rsrc...8y... ...z..................@..@................................., ...../.<.Q...L=c..;..l......l\.t5_..H=...t{......I.......A..................................................................................................................................., ...../.<.Q...L=c..;..l......l\.t5_..H=...t{......I.......A..................................................................................................................................., ...../.<.Q...L=c..;..l......l\.t5_..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	53362
Entropy (8bit):	7.422250599366755
Encrypted:	false
SSDEEP:	768:83BhO1ImvmtrEXhan/fiodk/cDXhMhchQhQhDhlskDhLfh9hFhvihyhchthw+KQo:8xtn/fiYUkLNlF6Q0I+dHm
MD5:	546E4C2B1A5E43933AB39E2C1A4CFCF2
SHA1:	CA3C644C75819E0AABAC1D3AF76783BE858E501C
SHA-256:	ADFC54524EAE2924C368136051B7BC9FB6AE14389B2D57BBFEF7F4761204D6EC
SHA-512:	420AF25F60D103F1C4F72B783A1B0C73CC0030C8295B4E2153186EA57B30AD1C04A9E56C457FB7B7FA6A19B69BC8CBC60ABB5D92A8712D305C54A21A10C8D11A
Malicious:	false
Preview:	...<.F.^.ZcW=....WA.\....:%..E.......U)......9.G..\|.....p.........!..L.!This program cannot be run in DOS mode....$.......u...1.1.1...0..~.0.1...0...0.Rich1.........G.n<.F...Zc.D.....6A.\.P...%..N........)......9.G...\|..._B.p..................................,....`A........................................ ...4............ ..................8E..........G.n<.F.Z.Zc...."..WA.\.P..:%..E.......U)......9.G..\|....C.p..................rdata..............................@..@.rsrc........ ......................@..@................................G.n<.F.Z.Zc...."..WA.\.P..:%..E.......U)......9.G..\|....C.p.................................................................................................................................G.n<.F.Z.Zc...."..WA.\.P..:%..E.......U)......9.G..\|....C.p.................................................................................................................................G.n<.F.Z.Zc...."..WA.\.P..:%..E......

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	49770
Entropy (8bit):	7.7181231802261845
Encrypted:	false
SSDEEP:	768:m7pxriYnWdy+nKzVESLT/e9OuOVkEzMl0p7N3SU5ZDrhin:0fWkVu9Yn5SmZx2
MD5:	F670E65F753936A61102D0DC146E1E39
SHA1:	AE2C4B2146F518D983EC286B7958DF7539C1F601
SHA-256:	8F38B96071BFB6EACCD3099AC0036A05BBB90CAB86525D9F27D9B265BBEFFA29
SHA-512:	2F6A962BDBABD7C8D971069E42D1F6C7D4B2550781216E6C0DA819B116ED60D9147C7337F4891CDE80991DD8F2940B867827C843C04D12044C98ED3942DB8F7D
Malicious:	false
Preview:	U.5.+fy9..f..9.mT..w..e..[j...9W...Z.....r..........\|b;.)..T..........!..L.!This program cannot be run in DOS mode....$.......u...1.1.1...0..~.0.1...0...0.Rich1.............(fy9..f.X@.m5.....e...[j....2U..Z...r.r..........\|b;.)d!T........................................`A........................................ ...4............ ...u...........\|..0E..............4fy9..f.<.m...w..e...[j...9W...Z.....r..........\|b;.). T...................rdata..............................@..@.rsrc....u... ...v..................@..@....................................(fy9..f.<.m...w..e...[j...9W...Z.....r..........\|b;.). T......................................................................................................................................(fy9..f.<.m...w..e...[j...9W...Z.....r..........\|b;.). T......................................................................................................................................(fy9..f.<.m...w..e...[j...9W...Z..

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	49802
Entropy (8bit):	7.720780290091156
Encrypted:	false
SSDEEP:	768:1JavJkTd8e0i41Lb6NpucDmkFDxL1imVG6kkHyNX77uwuyCDktyJwm9N6Pcw:1kyTl0tYSkVRzy7BOE3Mjw
MD5:	DE3A8FAEB2CA891CD39A4A1D5DEA53DC
SHA1:	401D9F7DBA2831E736FBD568F993F6DEBDA8740C
SHA-256:	469218E551C99CA7923100B81E6DBF2719094BA9123CCF2C59D3E243B5538FED
SHA-512:	673B925E0D42623041BCDB1DF746E754B0DEDBF7481D475BC302E1F8F58BC05A48639417D121C03EB4CFCB2B388EE96529AB3ADEABB7D5921432D9AAB7DD7F7D
Malicious:	false
Preview:	g.K.v....P.N...H..(......Y.[5.........[..i.^.N......k..#........!..L.!This program cannot be run in DOS mode....$.......u...1.1.1...0..~.0.1...0...0.Rich1............u......N...)6...(...e.{.P7........[..i.^.N.........#......................................`A........................................ ...4............ ...t...........\|..PE.............i....P.N.w....(.....Y.[5.........[..i.^.N.........#.................rdata..............................@..@.rsrc....t... ...v..................@..@...................................u....P.N.w....(.....Y.[5.........[..i.^.N.........#...................................................................................................................................u....P.N.w....(.....Y.[5.........[..i.^.N.........#...................................................................................................................................u....P.N.w....(.....Y.[5.....

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	47714
Entropy (8bit):	7.659769219687582
Encrypted:	false
SSDEEP:	768:abHTr1SHmgg1B7DJjB17ZdcK3uq+IbZtsLIWsuCqtVDfYCXOKrNo/wLJb:cH10mvdZZ+KyBLVIqtpYCXOKJo/wLJb
MD5:	4EE1EDC66C1E987820E0BAD649E717C9
SHA1:	2BE4BCACCD0802C4A2EC3300A356931510ED0005
SHA-256:	F7004DC53A9F7845AF30D6C21C6E7F904BB4160A1312689A40ADFD60EAFFBA83
SHA-512:	9DC6161DB303D23D55D0E09922FA27CB2C203512ED2F7A52AB3172E6AFEC9DE15EEA54E52C3F71321D4954AF9E81B88B8E52DA4AA97F7F650CA60486FE730B5D
Malicious:	false
Preview:	.~.n.&...p...b..%...".j...-..S...S:...;@....K.l.....T,...[........!..L.!This program cannot be run in DOS mode....$.......u...1.1.1...0..~.0.1...0...0.Rich1..........$"n.&..5....`.....".......X...S:..;@....K.l.....T.9..[......................................`A........................................ ...4............ ...l...........t..(E...........4"n.&...p..m\b.O%..."....-..S...S:...;@....K.l.....T,8..[.................rdata..............................@..@.rsrc....l... ...n..................@..@.................................$"n.&...p..m\b.O%..."....-..S...S:...;@....K.l.....T,8..[.................................................................................................................................$"n.&...p..m\b.O%..."....-..S...S:...;@....K.l.....T,8..[.................................................................................................................................$"n.&...p..m\b.O%..."....-.*.S...S:.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	50794
Entropy (8bit):	7.491921253540829
Encrypted:	false
SSDEEP:	768:4qBZngVFCbjK9aASP8hwCNA31U113s8oZa0h63QyWMQgE0xroDivo2K77aw1nMK7:474kaASPsjD5ofh0YyPK7uAMK7
MD5:	00BB4958C8F0025E5DEAC4589C89CC85
SHA1:	45C70C31BEB9106D8CDF3992500EE14F293245EB
SHA-256:	E94B70E5837934CA1A7EB8C48BDF9716D0D39BFDB6BCE0183F884C1BA7DCC9BF
SHA-512:	0EA38F8E56F55FAEC373E3DFEEBE93C303784D95BC9A0EB2118515662446CAFE5CA80351C0A319E45BC2D6F647CA4E11A6B32939D08D9A0E62D572817E060F89
Malicious:	false
Preview:	X8Y...7.mP.p{`.h...3r..%..IT.C.:u. .gd.l=..-..... .....~.9...........!..L.!This program cannot be run in DOS mode....$.......u...1.1.1...0..~.0.1...0...0.Rich1..........b....7.9..p...h.2..3r..e..I..a.1w.<.gd..=..-..... .....~K........................................`A........................................ ...4............ ...x..............0E...........r....7.iP.p...h+..3r..e..IT.C.:u. .gd.l=..-..... .....~....................rdata..............................@..@.rsrc....x... ...z..................@..@.................................b....7.iP.p...h+..3r..e..IT.C.:u. .gd.l=..-..... .....~....................................................................................................................................b....7.iP.p...h+..3r..e..IT.C.:u. .gd.l=..-..... .....~....................................................................................................................................b....7.iP.p...h+..3r..e..IT.C.:u. .gd

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	53890
Entropy (8bit):	7.4222915834637355
Encrypted:	false
SSDEEP:	768:fFhZ8Wn4dBBmBhcHf/9kNaNQDKSF+tdgQpTSackmkc6jT2X3da:fei4dBBmBGHf/SaNGKSudHSkHyXta
MD5:	278888C4F19C918EBC24547353F71C87
SHA1:	BFECA917AD88AAF666754230D7346962B58E6FD3
SHA-256:	0AA77ADC6056EC79081993B1AAEA37B0A4C8746614C612608FFBCAC4E2486C87
SHA-512:	220FC8BD8CD55F0FC5F43D5C579D73436E4C2F216C0ABBA6798A1B8C2C0E3FA5CFAD39693D7361ACEAA9D6B586CE1F67943FCB6F5B2D8AD390A25A3342E9135E
Malicious:	false
Preview:	.#d.....v...`.......o....R.8.F....e..dR.6..wB.......>...">.=.F........!..L.!This program cannot be run in DOS mode....$.......u...1.1.1...0..~.0.1...0...0.Rich1..........y......"....{.../..o....R.8.F.,..k..dR....wB.......>...".B=.F......................................`A........................................ ...4............ ..t...............HE...........i......r...........o....R.8.F....e..dR.6..wB.......>...">C=.F.................rdata..............................@..@.rsrc...t.... ......................@..@.................................y......r...........o....R.8.F....e..dR.6..wB.......>...">C=.F.................................................................................................................................y......r...........o....R.8.F....e..dR.6..wB.......>...">C=.F.................................................................................................................................y......r...........o....R.8.F....e..dR

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	52874
Entropy (8bit):	7.635456685698325
Encrypted:	false
SSDEEP:	1536:X84fdN+2EdQaM774ipTS4ctsQrZTK5EQX:XhU2EdfWsaTLjX
MD5:	1F2B7501D40CB2C23A6006A26734259D
SHA1:	67EBA1E0B7CCAF0D38D8DF2AD8449FE0773AB58C
SHA-256:	9E595B1351DFE79FF4D870D578761DA7B563C8F7D3D98A81DD60A2DB7CC8F2FB
SHA-512:	DB97B98BDB417C69EDCD1C22659180962636EE31EB37D9730A1B359948378A6727E4867FE9C98D6DFEEA5804A24090F1D734A2F7B20B5AFC92BCBC0BDC11313E
Malicious:	false
Preview:	...F...9Hf.S./.";....c..[w.Yi.......x..O...;J.P...C................!..L.!This program cannot be run in DOS mode....$.......u...1.1.1...0..~.0.1...0...0.Rich1...........wF...9.#.S~V."Z....c...w.Y........x......;J.P...C....G...................................y.....`A........................................ ...4............ .................PE............wF...9Lf.S..".....c...w.Yi.......x..O...;J.P...C....F....................rdata..............................@..@.rsrc....... ......................@..@..................................wF...9Lf.S..".....c...w.Yi.......x..O...;J.P...C....F.....................................................................................................................................wF...9Lf.S..".....c...w.Yi.......x..O...;J.P...C....F.....................................................................................................................................wF...9Lf.S..".....c...w.Yi.......x.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	54354
Entropy (8bit):	7.381362969379738
Encrypted:	false
SSDEEP:	768:ZbGdhfIzyhUVbvY7v/Encdd1FpK7Dgh+0iWrub7FThfLPaTcjwuWIo2sekeqH8:ZbUTc43iD+GToyke
MD5:	7C891D27756CB74C19FE76D53E636DB3
SHA1:	98C2554A29FEB7FBEB57AFF38A87EA90DDED75B8
SHA-256:	99E37BA091F41DDA2EF46A75EE43F85A87FF2108C5A14E7A6C750D9EECA8053C
SHA-512:	55445E654CD3D753E60660CD1DCBEB1DD6FE4B07FB714759B36731578275045C46A3ADF4634EAC2C40F63F959F7B0C9F1F9C8EBCBB3B52BFC112F73FD71B396A
Malicious:	false
Preview:	.^B.....m.^+6H.e..c."M.mw2Z#....u.LF...4....+.b..K..c..T............!..L.!This program cannot be run in DOS mode....$.......u...1.1.1...0..~.0.1...0...0.Rich1................9.^+.1.eb.g."M.m72Z#.....w.PF...4j...+.b..K..c..TU.....................................Y....`A........................................ ...4............ ..$................E.................i.^+..e..c."M.m72Z#....u.LF...4....+.b..K..c..T......................rdata..............................@..@.rsrc...$.... ......................@..@.......................................i.^+..e..c."M.m72Z#....u.LF...4....+.b..K..c..T............................................................................................................................................i.^+..e..c."M.m72Z#....u.LF...4....+.b..K..c..T............................................................................................................................................i.^+..e..c."M.m72Z#....u.LF...

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	44658
Entropy (8bit):	7.517867325139953
Encrypted:	false
SSDEEP:	768:YbrKkgUvtGc8aEdSqYZPDfDsE1MU4tPRn+:YbrzRxuSZZ89Xpn+
MD5:	CF5C2C123474802B7228192C73C9C71E
SHA1:	A03F44901170F60C651D1E5AC8379E5EC0E850FB
SHA-256:	1DF058399B54FC582B13F6DC0B1FD6CAA3DD2669E721B30786CC830C0FBED342
SHA-512:	599DE5D729461505DFCD89CC42757017C89E91D5E3876F355AFE97784302B9F342BF77C9D595E857DC18779B6B1A667478AB5A36036CC8EE53D83AD293D53FF5
Malicious:	false
Preview:	8.b.0..w&...C.A.?.......4o......N.2A.S.0.....B..^..1..j.R............!..L.!This program cannot be run in DOS mode....$.......u...1.1.1...0..~.0.1...0...0.Rich1.........u...0..#c..:.A.......J.4o~.....@.2A.S.0.....B..^..1..j..I...................................>t....`A........................................ ...4............ ..la...........h..8E..........u...0..s&...Af?.....J.4o......N.2A.S.0.....B..^..1..j.RH....................rdata..............................@..@.rsrc...la... ...b..................@..@................................u...0..s&...Af?.....J.4o......N.2A.S.0.....B..^..1..j.RH...................................................................................................................................u...0..s&...Af?.....J.4o......N.2A.S.0.....B..^..1..j.RH...................................................................................................................................u...0..s&...Af?.....J.4o......N.2A.

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	44658
Entropy (8bit):	7.537050876671109
Encrypted:	false
SSDEEP:	768:s+3S5p7wGwL3fEh7fP6aZ9nEBvarKFqA0Yw4fZvc4:sXZ7wL3fEh736aMvarRYweZvJ
MD5:	9AAF8A7E1DC6F0B4BAA75BB550E23B81
SHA1:	7E5566732997476BFFB307412D5580DC267DE2A3
SHA-256:	57095B183E0AF5AE470756FAA1D4BBB6972D7E50C4273E5F23B0B10B9CFECCEA
SHA-512:	5600B9729DB9DF8DD0B8EE9CB5ED128EED78F7622FCE03B812F5B89F1FB2DAE542CDE51844637900256DACB48ECE09077DE28E4E72EF9E76B14AFD143120C963
Malicious:	false
Preview:	j...+.`..}G.%N...T.....:..S..A.~..!....]Q......._.....r.....)(.........!..L.!This program cannot be run in DOS mode....$.......u...1.1.1...0..~.0.1...0...0.Rich1.........'.h.(.`.H8G..7........:..S.vA.^../...]5......._.....r....*)(.......................................`A........................................ ...4............ ...b...........h..8E..........'.h.4.`..}G....\|T.....:..S..A.~..!....]Q......._.....r....+)(..................rdata..............................@..@.rsrc....b... ...b..................@..@................................'.h.(.`..}G....\|T.....:..S..A.~..!....]Q......._.....r....+)(.................................................................................................................................'.h.(.`..}G....\|T.....:..S..A.~..!....]Q......._.....r....+)(.................................................................................................................................'.h.(.`..}G....\|T.....:..S..A.~..!....

C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	3113642
Entropy (8bit):	7.287872416479118
Encrypted:	false
SSDEEP:	49152:Qls5fMoWrl8ZDN5CrjP5F/IIHvD6k98wr6wLpzvFkoNuke6Md3akiMVF:zwyZyVLekDF7uUG3VF
MD5:	90E03755F0A88DD0D88035B875005ACF
SHA1:	588695A0C126846C37BCF4655806AB5E8C3DF773
SHA-256:	A717881D18A961F521F69767B9DACE6E0A23B5277726C92E05FCAC61316C5E3C
SHA-512:	D9C717532450E9065A4B589CC5649B299D94F401710BD829976E75BEDF1168CCC1B985D71A10EB352E8C49431A37B2D098A35D37986C3F8F2E9F8F65863BF322
Malicious:	false
Preview:	...a.F...=_......j'<+X.J.. ..f..."...+K......G}Z).Xp....oP.........!..L.!This program cannot be run in DOS mode....$.........c..........................................y`....E.I.$..j..4....Ba..Uh7....".."..M....F#....c..J.....F...[.]X6...o...6.....6...........6......Rich...........PE..d....:a.........." .....4............................................8a.F...._<%...FE'?+8.... ..f..."...;K......G}Z).Xp....nP...!.F.....!.\|....0'..a....&......</.pE..../..f..H.".8....................v!.(.......8............P.......!. .....................\..F..('_<1....p'</X.... ..f...".....Oa...&M}Zy.XpQ...VJ.............@..@.data....s....$......f$.............@....pdata........&......R%.............@..@.didat....... '......l&...........9a.F.B.hN-_!..t.b'<...... ...f..."...+KU...y".5J.X.........h..................@..B..........................................................................................................9a.F...=_<!....j'<+X.... ..f..."...

C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	377
Entropy (8bit):	6.306652270892568
Encrypted:	false
SSDEEP:	6:ivmt7QJW6Yik2lIEjcXoMjLpAifsrJ2YskW9cSju5Q9Wi4wn:iOt7QJWzifcYQVsFJVW9J3My
MD5:	82290274AD73541C7CEA7CCCAEC20997
SHA1:	BC7AE016497EC3C7FFC46E743F8238B9A8FB0DDE
SHA-256:	00CDF74DCD8A09FFCC11644F7C12C2B5DD9CCA85DF91EC83EE144F2E25C6DE82
SHA-512:	A41DAF5743C9328BD695AA6D976005A5DC04C5901538F2AE9FDBC1AE236F9C8779618BB6BE1369996427A569137E917C12FD72175F7599118EC1727C28E05290
Malicious:	false
Preview:	..._.&..~.Db..y..s......v..0 O..Li0...u.....:..q-H.$9.!.w.....'/.......v....m......_..i@.]..F//."A....=S.s..!]....[._.........l.......T...5YU...G.U.......e......8.g.J.o7h.'5..l...\|.].FZ.H...........<...!.m.4(@;.6..@6Y..+.......nL .'.A.{...?...H.......................................................................................?.........vux2f891j9j.

C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9424
Entropy (8bit):	5.477064203046047
Encrypted:	false
SSDEEP:	96:Dr04bXwGZnMWtGwiDwop/pDkVMzfUYfcWkR9Qn0SARe0uOfG2Bqs15jwVDRAAOWK:GFXp/xbfb5yFdG2BqW6VDqATIT
MD5:	8BE96555F57B6F21CFA1750211E6AC93
SHA1:	F84C26B260D68509D48609A3CF7E7B12DC4CA78B
SHA-256:	1ED7B19D4267DB38F8EE7513DD1771ADE1C8FC4E4ACE72C67AB649C824DF5190
SHA-512:	1BD176A344E9AE7C8D585D2F375D7E141AA71CF2C8F2EEA43EA8FD4DEB604889FDAB42A9C09DF4AA95BF8A1C593088A2ECFE068495BF02C225443D6A4C9EF9AB
Malicious:	false
Preview:	\...z$*4.c..UH...F..\|.V..a.R.._Sb.1.^D............W!..f.lxx.t.f.-.1.6.".?.>.....<.i.n.s.t.r.u.m.e.n.t.a.t.i.o.n.M.a.n.i.f.e.s.t. .x.s.i.:.s.c.h.e.m.a.L.o.c.a.t.i.o.n.=.".h.t.t.p.:././.s.c...D.($34.c..AUW...F..f.V..a.R...S#.l.SD...........\..!..k.vx".e.v.e.n.t.s. .e.v.e.n.t.m.a.n...x.s.d.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.....u$j4.c.ZU[...F..7....a.R_..S?.;..D..........I!..t.ax`.a.n.i.f.e.s.t.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.w.i.n.d.o.w.s./.e.v.e.n.t.s.". .x.m.l.n.s.:.x.s.i.=.".h.t...Q..$}4.c..[UI..F..;.V..a.R..\S\|.1.MD............\!..:.cxd.n.s.t.a.n.c.e.". .x.m.l.n.s.:.x.s.=.".h.t.t.p.:././.w.w.w...w.3...o.r.g./.2.0.0.1./.X.M.L.S.c.h.e.m.a.". .x.m.l.n.s.:.t.r.a.c.e.....-$&4.c..U...F..}.\..a.R@.@S!.h..D..........B.Z!..6.axz.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.t.r.a.c.e.".>..... . .<.i.n.s.t.r.u.m.e.n.t.a.t.i.o.n.>..... . . . .<.e.v.e.n.t.s.>..... . .....e$r4.c.^UQ...F..p.K..a.RR..S).<.^D

C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	5222
Entropy (8bit):	7.115542475581803
Encrypted:	false
SSDEEP:	96:4yk2f8cPT4rHWrxC75jCA+ktbC8jZ64yZxtS5fQJt8L6kOY:q20mT47WE57vtjo4yUMqL6FY
MD5:	7E2C4C7266CD3652F7EB3F8D94751D21
SHA1:	BEA5B69462823B0C41801D86DDDAF85DFD957416
SHA-256:	B5F5C3546049347738F97ED42879B08AA00C0FA4ECE80116FEB5CC9327761A53
SHA-512:	5CC1A868383BAA9208E09D4643D55FA2733274A143B2EEC5FDF56009E671E50F62008409FF0089B80A92108E8F811509B793F1221CE1E93A53C8BFED5D804832
Malicious:	false
Preview:	..Q...l...=..&.G.({...:_.2gE9.K..9........2j&2.'.j....q.Q.oUg.3T+...%....=...&.Ge(4...4_.21E;....9.......2jx2W'.j...4.L.5U_..T...)...=..&.GU('...&_.22E~....9.......?j72.'.j....b.B..U]..TB..}...=..&.G@(:...e_.2uE+.H..9.......(j$2.'.j.....f.mU..[T?..s...=..&.G.(a...;_.24E}....9........\|je2I'.j....s.R..U..VTZ...$....=...&.G^(:...d_.2`E.B..9........ojw2D'.j..w...(U..jTg...4....=..&.G.(`...'_.2.Er....9.......(je2:'.j....u...qU..&T...\|...=...&.GO((...u_.2.E~....9.......5j2.'.j........mUF..T...4...=..&.G.({...!_.2;Eo.Z..9........j,2.'.j....y...9U..(T...}...=..&.G.(\|...9_.2;Eo....9.......2je2.'.j....}.L.+U]..TM..d...=..&.GA(4...._.2)Ex....9.......2j{2x'.j....C..UW..T...`...=..&.G.(A...3_.2dE..p..9........5j"2.'.j....(.a.GU..GTM...(...=..&.G.(i...._.23E\|....9.......\|je2U'.j....?.9US..T...{...=..&.G.(6...e_.2jE6.K..9........ljv2O'.j....&.\.qU..4T...f...=..&.G.(i...,_.2WE..Z..9........`j.2.'.j....s...sUF..T...(...=..&.G.(m...k_.2PE;.Z..9....

C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	47226
Entropy (8bit):	7.138210351636832
Encrypted:	false
SSDEEP:	768:jiKq1IEhZ887enFOvGEhz14sBVgAc2ii2h20IfyFppZHVu:j+ObQvGkjjgAc2l2h2Happru
MD5:	F54D60CA164183B3A73297FF9A5DFA48
SHA1:	BAF952FE0241DCDF57E8FC96FAE4F4A021DAB614
SHA-256:	7210E94585A09BFBA3EF0A7A92538DEE91D900E5379703244DD05CD6C27EEC24
SHA-512:	767C4CC5F65C5D66A7801483B9B1B50F4BF793D6AE92EA90BFF331E908A07DE7C5282363877C4A8DC743B350EE9F755E8B86453B517E343D3FA589302D78AE5E
Malicious:	false
Preview:	..h S....]1....'..0.\ V.PT.0<\a..K... ~..39.....\|(.....8{.7 {........!..L.!This program cannot be run in DOS mode....$.......PE..L.....)..........."...0..f..........v.... ........@.. ........ P....]1.H..'..0.\"V....0?\!..[... ~..39.....\|8.....8{>7 {!...O....................r..@E..............8............................................ ............... ..H............text...... P...;1.H..'..0.\ V..T.0.\a...8... ~...39.....\|(.....8{>7 {....@..@.reloc...............p..............@..B................U.......H........:..XH......,..................................... P...]1.H..'..3.. V..T.0>tz..H...<~.0K......\|(.0...Wp>7&....po....(.....r...po....,...(......{...."..}......{...."..}........0..G........{....-8.(....(....,.(.....(.....(....( ...... Z...E.1.B..Z..0.^[U..P.NCa..... ~....9.....x+.....8qD5#.$...(......(......{...."..}......{....r.(....-..(.....o%...o&......(......0...........(....r...pr...po'...~(....~(........(Y(.*];.L..U..0.3.V..x.6.Ba..F... ~

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	3228442
Entropy (8bit):	7.096534478657255
Encrypted:	false
SSDEEP:	49152:tFdYRunCB4AKoOzUO1zW6UBu4cDRsCeXZcvExUN9CSKhmpXjbNFzCvCOXZZS:RYRunnASH1cAq4gS4QjbCnK
MD5:	C5A344AB2483A436052A45C656F59906
SHA1:	3D2061D892ACC3C999BE4A30B13BCE3355946A9D
SHA-256:	0224536A6F0A32F964F3CB7384BCFBA8A9CB5A7EE73E47CC49FEA90EC6B274A9
SHA-512:	0E5475943FA60F4EDAD85B7345FE8AFC6E392D3536C56B8DDE9609AD17BAA464FD364041D5C58BCD8430CFBC1E12DD90BC94D5E14B237D11CA9F3181088577EC
Malicious:	false
Preview:	....LX.....U.Z.....Yc..>pD{rD....j..>.Q$....X... ....k............!..L.!This program cannot be run in DOS mode....$.......y..=...=...=..........Q../...Q..5...[.V.?....}..5....}..<....h..`.H,,.-m...G.=}2e.]....X..i.-.6x.8.uy..x.h&yah.9.)\q.F.K.6...m.....T.<...=.<.<......<...Rich=...........................PE..d....:a..........".......!..t.................@...............OX......dZ.....Yg..u{pD.U..z..>.Q$....X... ....k.X..................,.).x.... 0..I......\o....0..E...p1..r.. ..8.....................).(.....".8.............!.......). ..............OX......dZ.#w..Ys..~.e{r@....j..>.Q$....X....T....`.XP...B....!.............@..@.data.........,.......,.............@....pdata..\o.......p....-.............@..@.didat........0......8/....OX......dZz ...."..pD{rT....j....Q$..*..X...`.......;...I... 0..J...>/.............@..@.reloc...r...p1..t....0.............@..B...........................................................OX......dZ.....Yc..~pD{rD....j..>.Q

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	194306
Entropy (8bit):	7.20765364418589
Encrypted:	false
SSDEEP:	3072:gvttNgFJPbpuhOGEjgmbP1vtnNyQXkemqtaRAZ9DGkiDZSrYnOXvlMHTTyLMe:ytHwbpGEjgUZTkitdZhGkiDZbO/ltMe
MD5:	8273BB17323F5CA888C4E6A68C8249C4
SHA1:	843F7F9DE73874342416824061FCA0D295CC82AB
SHA-256:	F4FB01B14BED3F60E101C94594355D5A10D1A7F955FEF385E3025514A21C177D
SHA-512:	5D6A44ECF29C7746224C70F9F353FEB02B55CC66075A73BC6BE3820CFAB1665C0A74B790A34ACF3393D5699EC96FDE63E9BBAFF0F6027DD2E016F79F37B4AF05
Malicious:	false
Preview:	..^..T`5.......gP.%-:~..Y#.......h.=H...(..........${.:.............!..L.!This program cannot be run in DOS mode....$..........K.k...k...k.......k.......k.......k.......k...k..Ro.......k..WP..%?.-.....[...K5.....:...C.....#D..(........%~.2T.cf...................T......@V............@..................................h....@...... ......................................(...JI..T`5.~..!_.g.N'-.T...\|..D....h.=H...(..........${.:..&...........................................text............................... ..`.data...............................@....idata...G..b5.......g.%-:~...#..P.....^H...(...........y.:..f......@..@.reloc..0.......,..................@..B................................................................................JI..T`5.....~.g.%-:~...#.......h.=H...(..........${.:..f..................................................................................................................................JI..T`5.....~.g.%-:~...#.......h.=H..

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	21857986
Entropy (8bit):	6.967611835642365
Encrypted:	false
SSDEEP:	196608:Nz8ziKC9bXBs15Nql8nNJlhWMX4EZDxBzZrgg4RQoI6fnD6k4GO0PT:JgiKCns5MyLn4ElZrXfo5ut07
MD5:	35AFCF790B149F1752E884C02D33CD00
SHA1:	FCA83BD4A80BC0B04F2AA6D9FBFBEA30FD73A4F5
SHA-256:	D2591B7779BFBF4D4244E762D30EC5467DB8060DCCE0E4D771D2BE7D89041CBD
SHA-512:	C9F76FBEBF9B5204B4EDADE21E0DBD2DE2A60EE3EFA350F59286A1EC09EDFE06F8EE06A59F49EFEA10554E311BC146CEBFC77D43147029353093A266457B0F05
Malicious:	false
Preview:	...h........z Fc......?........R[&....D.o.O1.u.o. 5.N.....uS.I........!..L.!This program cannot be run in DOS mode....$...........X{s.X{s.X{s.Q..@{s.>...Z{s.4.r.^{s.4.w.R{s.4.p.Z{s.4.v.r{s..Zer;.........S.[.\$.lq.D..d..].l[+....j...8.J..mf..la=...r.\)....v.[{s.X{r..\|s...p.Y{s...v..{s...z.#ws.....Y{s.X{.Y{s...q.Y{s.RichX{s.........PE..d...T.:a.........."..........0.......\|........{.j......... F./....?.........'.....!.M1..o. 5.N.....%R.I.................................+..X....... .2..p...m...@M..E....J.....H...8...................(...(.......8............ ..`!................ F......?........<Y.&....D..O5.u.o. 5.N......R.).rdata....i.. ....i.................@..@.data...!W.......2..................@....pdata...m...p...n...0..............@..@.didat..R.{.k+........7G......?.....i. (T....d.].O..t... 5.Y.....%R.I....@..@.reloc........J.......I.............@..B..................................................................................{.k......... F......?.......R[&....

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1617610
Entropy (8bit):	7.0786160721738
Encrypted:	false
SSDEEP:	49152:66eLaMa79g5iqJFIHFXBLzS0/ocJ3xyjpqzStjfhoLw:SvVZ3sH/z3xyjpqA+Lw
MD5:	533C2E597A4AC18437688FAC7CA5E043
SHA1:	3828D5AEA24BF9AE46034CFEE3F2A56931ECED6F
SHA-256:	A105C1EDD2BC1F82BD1B1DA1574B8EC9D9036494AAC938627D285DCC16BE50C7
SHA-512:	5924778DE8F2B61287145824EC8D4BB58B053DA611803D8BD34DDBC0209E2A8DFC0C75A0427372E18AC0894C5349D73E2FDF11CD6FF1BECEF04D1A0491E5E4BD
Malicious:	false
Preview:	.#...1...^.n..1#...:z:..l....G.....KG.'.9.5;/.1e.O..4Q.E+..t.........!..L.!This program cannot be run in DOS mode....$.......>...z...z...z.....j.............j.......p.....>.x.....x...U.t..sN.rc....../.. .So..1q.....V_(..+]m._u..k'.7Vi.o.....W....?.........<.{...z.T.{.....{...Richz...........................PE..d.....:a.........." ................p+...............iQ..3...^.n`E1#...:z:..,...C..W[..K'.'.).5;/.1u.O..4Q.U+.t.................<M......dY.......................h...E......(D...v..8.......................(...P...8...............(....M.......yQ..1...^.n`E1#..B.:...R...W......OG.'.9.5;/.1e.o..T..!J..t.............................@..@.data...4...........................@....pdata...............@..............@..@.didat..8....p...}Q..7...^.n`E1#...:::.As.....S..._.'.9.517.1e.O..4Q.E+..t^.rsrc...............................@..@.reloc..(D.......F..."..............@..B.................................................yQ..1...^.n`E1#...:z:..,....G.....KG.

C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	4446
Entropy (8bit):	7.116706890120681
Encrypted:	false
SSDEEP:	96:nyuU/aOOOi7J+dw45tkVrazBq5kw45UHNLXW3:VPOIcy4L0oIWwOUHVXW3
MD5:	F9E30CEED70907AE0B81FA27049F1C6D
SHA1:	16C9CB1D6C8DD127669A9C465169DFBA16E91E0E
SHA-256:	7F70C36038CB33D30A4199F6776331E56E8E5266AECB1CEDB950E13B61814DD3
SHA-512:	99207BD5FA3FA0CAF73881134136979EA17D44A3EB2FB9B46F5EAE9EA70B64387D2A77DC002B86F9B9FEA38EA7482813A9EC207CDF81BFA9ABB04685932BD687
Malicious:	false
Preview:	[.i8..fc..e...$.3...G0;q.....?:..h.}z.\.".t.d..0.....Y.......38....=cC.z...$.3...I0&q....?q.^h.}3.V."..)..0..].VY.......;8....)c..1...$.3....[06q...?u._h.}7.P./.e.d..0.....Y.......z8....ec.....$.3.....0aq.....?;.Ah.}....8.v.x..0..Q.yY.......8....bc..1...$.3...F0.q...?.!h.}z...l.7.7..0.....Y......`8....;cL.t....$.3.....0dq.....?9..h.}`...\|.+.$..0.....Y......u8...7c .0...$.3....e0<q...?g.Ch.}......q.m..0....HY.......=8....5cl.O...$.3....l00q...?}.\h.}3.V.".)._..0....TY.......u8....ec..1...$.3...@00q...?u.Xh.}z.V..7.r..0....TY.......:8....mc..e...$.3...M0uq...?w.Gh.}5.k.9.y.X..0..O..Y......08....xcA.&...$.3....I0;q....?f.^h.}(... .x.l..0.....Y.......'8....dc..1...$.3...[06q...?`.Eh.}4...A...+..0..@.&Y.....!8.....c.....$.3....0Xq.....?(.xh.}3.^.+.r.y..0..b.~Y......i8....gc..+...$.3...A02q...?.!h.}z...l.7.+..0..=..Y.....!8....ec_.H...$.3.....0uq.....?].Bh.}?.K.:.v.g..0..^.0Y.......!8....}c..)...$.3.....0uq.....?4..h.}

C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	537655
Entropy (8bit):	6.700596171462914
Encrypted:	false
SSDEEP:	12288:5G6nqaJNqb2XPDFfLx2TZumMcmFmA44PT:5G6n3qb27FfLx2FumMcmFmA1
MD5:	CC99633491173D1ED5B1B0A90ADE740C
SHA1:	0C8C5B3243D0B23A5F8DBA4D3EA7221BAE6CDDB2
SHA-256:	8AA155E194C24BD2E5F701487F757BB7127A3BAF78C61F80CED290896972CDEF
SHA-512:	874D61E4B7E2E9D956EB4A27BCDECA39E534BA2FE3B2B84E79A3B03223976889748B0EAB11A4BF7547420B9E2D78D7EC49F2108514B4570E886BAC2E632540A0
Malicious:	false
Preview:	.....>.xXsH..p....;.........}..R...@..U.D.p'....6......o.KDmentationManifest.. xmlns="http://schemas.microsoft.com/win/2004/08/events".. xmlns:win="http://manifests.microsoft.com/..I.._).0.].$.S..o.......J..4....GX.BJ..j6I....~.r.m..{W..01/XMLSchema">.. <instrumentation>.. <events>.. <provider.. name="Microsoft-AppV-SharedPerformance".. sym...[.N=R\|Ie7...~..Sw..........Q...u0.u'm.X.k.....L.@.."P.r.. guid="{FB4A19EE-EB5A-47A4-BC52-E71AAC6D0859}".. resourceFileName="%windir%\system32\appvetwsharedperformance.dll".....F.>O=GeR..*.q..yj..........1....Q...+I.n4\....{.a.&..s.TPnce.dll">.. <channels>.. <channel.. name="Microsoft-AppV-SharedPerformance/Analytic".. chid="Alz...F.>O=. .R.9.G..>e.....M..4....B.H.J.r......L.Z..!$C;uxENT_SHAREDPERFORMANCE_ANALYTIC".. isolation="Application".. enabled="false" />.. </channels>.. <.....mQ. .R.m....3H.......`..4..Q.

C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	27871
Entropy (8bit):	6.74301042792658
Encrypted:	false
SSDEEP:	768:xPl4AneDYxqDIg8Rx2YVI/5SG2H+5OLwc:hl49shg832Y2/5SG2e5Bc
MD5:	AA3F607DFCE32C993F1962BD20B9224A
SHA1:	B508557D2C421B9FB6AB222476978471EA3062F3
SHA-256:	4517CE90097AAD2AF21CF63832E869FE4423E1B2EB13F192421DB6273E20AD2D
SHA-512:	8611393D4B522475A5A1329858AEED4B1ACB8F1EB195B08ADC515611C679A3D513D427EBD77C68D1F8A6D4A83C15C34354A44B0420786D0DD255147C61CD2083
Malicious:	false
Preview:	.."..-.....z7....0....p.uhD..../.R.S.H....;....1w.1.L.B...A.U xsi:schemaLocation="http://schemas.microsoft.com/win/2004/08/events eventman.xsd" xmlns="http://schemas.microsoft.com/win/2004/..u..h.....m4..I{...k.l<..W.. .....kl...'.b..zz.=KR......../windows/events" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:trace="...."U....x8....]`....k..iN.M..f.Z.X.u9...-.y.] k.3.....*...W.Sumentation>....<events>.....<provider name="Microsoft-AppV-Client-SubsystemController" guid="{D49E7F7D-2036-451A-9EE6-6EF93BD216..'..~.....({...wV....V.NIp.\| ?..:.3..H.'9.%X.!.J..)z..w...h.s" resourceFileName="%windir%\system32\appv_etw_subsystem_controller.dll" messageFileName="%windir%\system32\appv_etw_subsystem_c....a....y5....Ma...=.4uW.S..g.....6u...'.y..8u."Ju.J.....@me)">......<channels>.......<channel name="Microsoft-AppV-Client-SubsystemController/Debug" chid="Dbg" symbol="CHANNEL_APPV_CLIE....O).<..X....l]....@.YDv..T.0...N. c

C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	309442
Entropy (8bit):	7.06304200179339
Encrypted:	false
SSDEEP:	6144:9Yx6G664+vIqa5dOuUJsDPZ6RqTJx/JKBOK0h646WYl/:6x6GXvna5UM60qWYJ
MD5:	6DF4382032DD68F11C9A19941FAFD1B2
SHA1:	B6E32E48BABDA1ABD7DF5BC7E878A1424B9E27EB
SHA-256:	10B046C6802562794D45A40B580C6A50EDBD125D93BAE51A994FBB4D0A71B7FA
SHA-512:	FE3C50E5F19BE71B6CF719D23BB89DB9990521D3FDB85E1B7EB67125D78A926D84630A4E6281938FF5BFBD75CA1338305DAB14276750A21179EDC9351FF4B891
Malicious:	false
Preview:	....r..u.....x.G..Y.../..hR.P..y.AE...}.gBH.Xg@@...\...%ta.1........!..L.!This program cannot be run in DOS mode....$.........1.S._.S._.S._...^.Q._.Z...Y._.?.^.T._.S.^..._.?.[.[._.?.\.W._...c#v\J..4.4.HT..6...3p..5....o...).)..}.gBH.Xg.........#z.a.1......" ................0...............................................w=....`A........................................@....M...d=...u.?.....G$.].o./..lRIs....A5...e.dB..Xg@@...\...%.a.1........p4..8............................................text............................... ..`.rdata..V2.......4...............t9.1..5.....G.Y...+...hR.D..y.AE...}.gB..X.n0.y.=....%...1.8...L..............@..@.rsrc...............................@..@.reloc..p...........................@..B.........................t9.q..u......G$.Y.../...hR.P..y.AE...}.gBH.Xg@@...\.*..%.a.1.................................................................................................................................t9.q..u......G$.Y.../...hR.P..y.AE...

C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	2761754
Entropy (8bit):	7.153733407254355
Encrypted:	false
SSDEEP:	49152:7WqEXhtMIapnSVYKDEOGHoqoZfpddzU549GXAZQSZL0DP:7dIGSyKQKpdd41ZeL0T
MD5:	B91F23C98F2A73289BF96B20B0F6F88E
SHA1:	8C63A137A54F2C5FA270DA236318EAC268571911
SHA-256:	A7FE4B7FC82585DB81FDA572595E7F29FABDFAE357D057655065D2D7AE9F87F7
SHA-512:	316EE099C6749FF87A78884373C9982D477D1CB7453B6D82D9B9378C7C449FA9924A1D75E9416F543A9565D3A5B64FE66573200F435B22809DAC9EE18CC1F8A7
Malicious:	false
Preview:	.^...d.^..o...`<A.V...i.'H.k.=..wyt.l...E......>R...~q.../.g.u........!..L.!This program cannot be run in DOS mode....$.........$..mJ..mJ..mJ.....mJ......mJ...K..mJ...O..mJ...N..mJ...I..mJ...7LX.....$.((....!..#>5Q...P./%`.$..V........Zl;..5p4..../.f.u................PE..d.....`.........." .........................................................@..........`A..................l..d.^..o.MD`<..V...i....k.....&V.....E...8..>2...W.q..;/v .u..).8k....".8....................x .(...`L..8....................X"......................text............................... ..`.v.....^e)f.MD{<.D_../s.gH.k.=..wyt.,...kg.xy..&)...Zq.^./...u............@....pdata...J...`(..L....(.............@..@.didat..P.....)......h).............@....rsrc... .....)......j)...........\|..d......"'`<..V...@.g$.k.M..wyt.l...E...X..>R...~q.../.f.u..................................................................................................................................\|..d.^..o.MD`<..V...i.gH.k.=..wyt.l...

C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	31269
Entropy (8bit):	7.512581288461797
Encrypted:	false
SSDEEP:	384:TICotJ11+G2HTHcfhD7ZQwcojoMJIjU+SNWotEgX9dAqWNsKt:TILtJKxHT8fhD7ZVjoMn4qWN7t
MD5:	889E907AC67AFDB1DD6391B0A3167138
SHA1:	FEC09CE046BC85F6D32109CB9B63E53B22FD0F35
SHA-256:	DB37DE739F9200BAF6B6644CF5B85B4248453E12018C9430BF16EA97A3435CD3
SHA-512:	99B2E73A2704515F786AFF6B6720DBE689ADE069EBEDAC02D7948A1E5F16770AFF880DC2DB98BAFAE2E208A84DBF3C723763F677A7E95C0A3E4E65076F257F59
Malicious:	false
Preview:	-Cp.LiD.P..xR.o-....,....v#....p.m^w@?]K[....)...u.Y3..H.y.jU.0...+.....7.....'j.[...A....>.....210913060706Z0...+.....7.....0.T.0... ...9V.........B>.\|.. .Y....C.H1q0...+.....7...1...0]..#wKdo.U.....J....R.k....G!..p.=t.Y.@.X{Z....@E...wl8.]..1u9V.........B>.\|.. .Y....C.H0... ..f4c.R.8o.:C..1..I...x.D..n..9T1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........8@zmh..PX..~....Y..H.t2....ZI.5.9Cq...C.9...NGu..D..=.Y.n..T.L:..;.3.R.S..U.HV..,XE.1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .U.y...L:..;.3.R.S.-]..6..N.Uw..P.....b..3.;3.L.....8.lar.^A@3........E,.9.._.........r....E...+.E.w..M...."1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .y......r....E....a.+..o..)ET.'.m..\.C..../.../.R.iY[%...&..!C"l:._J...}. ..x....i)...Ux....U..,....I..1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..x....i).xw.....nuE_Z..B%.....79O.*....(.d..

C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	420
Entropy (8bit):	6.059811288057556
Encrypted:	false
SSDEEP:	6:9tb67IPc6MampSMeo5IItPZ+AVsgqkCP7TA1ATGkD7+3RgXlAY6aeNtR/0R/+n:9xQeQ115IItx/3qkpATGkDEgBeFsW
MD5:	BB33D17FADD0F53806B6AC51578DF5C4
SHA1:	F4D8C79A09E08902EA6C7C608E5BB1791D7EFE08
SHA-256:	BAF69D611901555DF72E69376CD6BE552D351A89BB8D1F9C38BD744901CB54F1
SHA-512:	52B0674B26CDB25A949DC533119ECD50A768A59449DA7802C468EA8DEA4D903DF7B00F4CF165F4DD2A78E5566D2E8A2C0EE859A0C7445CE4F646C0BC2BC6AD31
Malicious:	false
Preview:	.s..'....En..B..t.. ~.r...~....J..7...-.3..C.?~. .,..}-..w%GB.9.....1.6...0...1.4.3.2.6...2.0.4.0.4...........I..@.e.5-{<%E.7..m...s~c..};^.7...GG....4nT).mMe.H.O..<.U..`.M}...B....}af...A.e.i..s. v..T.....r8....>. (u]."....k...S...>..?...^*...8..._lv^...G+o.ua..p...-....d.}94....U)"...y.6.U...e%...................................................................................@.........vux2f891j9j.

C:\Program Files\Common Files\microsoft shared\ClickToRun\inventory.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	5724010
Entropy (8bit):	7.189546324823811
Encrypted:	false
SSDEEP:	98304:2aBeyi+5UiVXsutsM8FF+5rkuRQJh7mWtDRgi:bNj/ZP4GrWJh6WtDR
MD5:	290516FA43E7483F597B0C62D0DE0469
SHA1:	357D991510F761BA92564DBF40E0A9040DA49DE4
SHA-256:	17BA9BEF77780F215BF510BE49E78B7CE7D9B9478A2C6BE9FDB27227C61AE686
SHA-512:	0CE4E0526FADAC2449153E9E549AE437AB84580A4FE2D98E30E1E462585202E653AF42EF5CA51CDEC63762CD6636332686C95E0D3A4EF927A25C4A77E70FC6FE
Malicious:	false
Preview:	.....<>^..h.W..o......23?FH`...".oI..a....P.....Zd.ZmQ\|..S..W........!..L.!This program cannot be run in DOS mode....$.......TK.u.n&.n&.n&.R.&.n&vE.&.n&\|^o'.n&\|^j'.n&\|^k'8n&\|^m'.n&..S.R....O~..0.'.".1...z)os..$2..o...#..1A?..W..}u>4K."...q.^g'",n&.^.&.n&..&.n&.^l'.n&Rich.n&........................PE..d.....:a.........." ......7......... .6.....................R.:..<>\..h}.........2...Hc..C"..I..a....P.....Zd.ZmQl.....W.........~L.......L.......V.......T.......W.0F....V.......L.8.....................K.(.....8.8.............7.X...t.L.............T.;..<>t..............2s.qH`...".oI..a....p....;.uZm...[.W......7.............@..@.data....]...@R......$R.............@....pdata........T...... T.............@..@.didat........V......,V.T.;..<>Z..h=......w...2.2FH`g..".oI.27....P.....Z$.Z-....\|..W......V......@V.............@..B................................................................................................T.;..<>Z..h}..........2s?FH`...".oI..a.

C:\Program Files\Common Files\microsoft shared\ClickToRun\manageability.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1386642
Entropy (8bit):	7.048071223526737
Encrypted:	false
SSDEEP:	24576:QlPmpFkzOzmtjDMTmCy+2+y8QSahc9LkTHTd2DWREvkJRUXVncHRNnHDqBQ/e2uo:QWmt5YZa97h9RUFncHRNnUQXOTwMGa8
MD5:	29D54AE1236F00670732F7828AD90FD5
SHA1:	7C3B4E39083D0AB2E27ABAE29DE0A1AB9F7A1862
SHA-256:	31B2C220B18BFECD2FFA1BA216428D3675678B7984C5BA333904256A21FB2831
SHA-512:	856CFFB4A052F8DE0BB79670C242A504A8F4A52917B1A6BE0D4AA1BE5B6A1BA4F1AA1EF6433865157DC682B0A4794FABDFBFEFA7DB46EC40E1E5E96EF77F6006
Malicious:	false
Preview:	l.#...."lT..['.{....X..6.0...OC...7>V..^+.."....L..6.....A.S.{........!..L.!This program cannot be run in DOS mode....$.......3.. w.isw.isw.is~..sc.is...su.is..hrq.is..lrj.is..mr..is..jrs.is.6.z5dQ..c.Jf...<..E..m..*.}$^L n.....T..s......j..U!.e.....sv.isw..sv.is..krv.isRichw.is........PE..d...T.:a.........." ......... .......f.......................................P...........mchT.....{j...X..6.0...OC...7>V..^+..2....}......f.S..S.{.........@..........XE.......7...{..8.......................(.......8...................@2..`....................text...[.......!h....."hT.....{j...x..V.B....C.K.2>V,.^..."G...L..6.....A..R.;.data............V..................@....pdata.......@......................@..@.didat..0...........................@....rsrc........."hZ...D.{j...X..6.0...OC...RR9....."....t..6.....A.R.{....@..B........................................................................................................................!....."hT.....{j...X..6.0...OC...7>V..

C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	660450
Entropy (8bit):	7.133690085898324
Encrypted:	false
SSDEEP:	12288:E9euFkW94E3Z00RuuBfMZdcaybx/46jKmygdEmW:aFk9IHxnjKmygdED
MD5:	E025135A6DF657F6D91181472E61175A
SHA1:	0362AB31408E9AF02ACC933CFD892F67506EAE54
SHA-256:	C1695ADDE959F86FA5B3DE934433D80DF9556024385A85CF40141A4050A32146
SHA-512:	6EACD4DB61E17B5BBFB8D5466C9833EEDCBE483CC561886E8E46E4BF06BEC97A6937E377EC64898DCF66DFBDD91897E7DEEB6E4C33AA14B9224137F6CEFBCB48
Malicious:	false
Preview:	...TM\|.+...?..DgP_.B.84....^.D..0...[_`.....3u.~.\..%..Nj........!..L.!This program cannot be run in DOS mode....$.......Ca.=...n...n...n..)n...n...n...n.R?n...n..%n...n.R=n...n.R.n4..n..<:.\|.E....Y..V.YDV_k,.j.}..,0....6.h.S2<.......3u.~.\.W%.V1Hj.aS.........." .....@...................................................`............`...........................................9Tn..+....d.?.\.m.\.B..=.[].^........U`W.....6u.~.\..%.2.Nj....................p............P...............................text....>.......@.................. ..`.rdata.......P.......D...>TN\|.+....?.r .^1_.B6.4..J.^.\|..0....[_`.....3u.~...bA.F.Nj.G.......H...z..............@..@.rsrc........@......................@..@.reloc.......P......................@..B.................>TN\|.+..X.?.\DgP_.B.84....^.D..0...[_`.....3u.~.\..%.2.Nj.................................................................................................................................>TN\|.+..X.?.\Dg*P_.B.84....^.D..0..

C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	963554
Entropy (8bit):	7.2788357451797845
Encrypted:	false
SSDEEP:	24576:Clm5rlryZfdHv24vrrM31x7iUo9+vkfgLh3X:Sm5rudu6+6+cCh3X
MD5:	108280501083CD5F1AA8F49E35926C5D
SHA1:	1CF941C7D452B48BEB033A7C3B65C81C282A6A81
SHA-256:	F87A513EDE8E019C0526E6A2B59E1C547BF0BE7F49F33716D0D0750EA5FEE04F
SHA-512:	C9272BCEF5C50A3C3CB8C96303BFDFB442AD25859BEFC710844AE08AD8ACD3FFB9E7A6C9334A3FFB541466089C6282D2626FBA226B1FE6515394814CB91DF299
Malicious:	false
Preview:	..C.........$"..xS...f.........I..y...\|....1.P......Wkx.............!..L.!This program cannot be run in DOS mode....$........F=&^'Su^'Su^'Su..u]'Su^'Ru.'SuSu.u.%SuSu.uo'SuSu.uh'SuSu.u.'Su..\..O.........&>..A......)...I..y...,.....P)/......Wkx..........h...:.......)....................................................`.................................................@...(...@X.........[....'...X............e...\|....1.P......Wkx.c....2..p............................................text....g.......h.................. ..`.rdata...8.......:...l..............@..@n.............................I..9..uR.c..P.Pi...O..W.x.c.............@..@.rsrc................^..............@..@.reloc..8............b..............@..B................................@...............S...f..........I..y...\|....1.P......Wkx.c...................................................................................................................................@...............S...f..........I..y...

C:\Program Files\Common Files\microsoft shared\ClickToRun\officeinventory.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	638226
Entropy (8bit):	7.124383583485062
Encrypted:	false
SSDEEP:	12288:IyT/+jPskxvQi+d5m+3l6g1htDWau833MgLXxkXYL:IyT/+xvQCq6g/tDWa73MgLXxk4
MD5:	2B9F511050EBEF1A4A7EDAA577C7A0B2
SHA1:	8413053DA2555A00233450065EDB3F55FE5DEC07
SHA-256:	F3CA7CD24C093623599FF3436F22160999B89972B558A0729DE51D77E238CCDD
SHA-512:	C4E8DCA1A2525FEAE4216DDCA3097823C02A0B017005CAC643512B2A105C59FCABAF67E4B9274C6B16B188EF1D105ED455EDEBE577322E9443673443786A4E1F
Malicious:	false
Preview:	..:@Q......Pn.3..#.I....2..N...5....(..u.....{.\.....L\..S@..........!..L.!This program cannot be run in DOS mode....$........W..6o..6o..6o.:....6o.:....6o.:....6o..Yk..6o..Yl..6o..Yj..6o..G...?.)....:.\.K.?...`L!;i.v....o....=&..5-g...L.r...j...w.&HYm..6o.Rich.6o.........................PE..d...<..^.........." ................h...............................................G..@P......P..3..3.I....r..N...5....(..u.....{.F..... @...A......8....p..PR...................\..T...................p^..(...@]..0............................................text...\|........F.@R......P..3..#.I....\../...58.....u1....{.\.....L\..;A...data....3...0......................@....pdata..PR...p...T...2..............@..@_RDATA..............................@..@.rsrc......@R......P.{:..#.I....r..N...u.....K...q....{.L.....L\..{A......@..B...........................................................................................................................@R......P..3..#.I....r..N...5....(..

C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgr.exe

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	4103098
Entropy (8bit):	7.099234211558575
Encrypted:	false
SSDEEP:	98304:FSG2NqJRv1gMt0b2C3LySis0wNbjMPyBor:EG2MSMtA2C30sxNor
MD5:	F8CF62240C70AD29037D5F71A74CD096
SHA1:	68AF5753A37589B669A67E50EBAC65E43D4EB102
SHA-256:	678C004CB955A08973310089BCF21A941B1CD9248C1F27E7990F0F2B852DDB34
SHA-512:	4A001813653CFDC11E08DF2CAC8043C6A9BE0C2FD53E7384C03B368A7D6915F811E669D21670C579C7AE2A6BC3FD9E3C949273D259EE524303A8897CE8560810
Malicious:	false
Preview:	f_:....+L}p......x0W...l8$..GK..w..w...H.3..Z...f...\.k.<..\|w........!..L.!This program cannot be run in DOS mode....$.......;.!f..O5..O5..O5v..5g.O5...5}.O5..N4w.O5..J4V.O5..K4u.O5..L4{.O5...9......9.R.!..~c.lC.S.j.._.~gc;..............$ .1~.i.. ..`3B...5~.O5..M4~.O5Rich..O5................PE..d.....:a.........."......t.........P,(........@.............................`?.....B_......H}`.,#..Nh0W...,84..GK..w..w...H.3..Z...f...\.X.<n.\|w..>......`<.(-...T>..F....>......6.8...................(.5.(.....+.8..................."6. ....................text....r*.....+q.....+H}p.,#..Nx0W.....J@..GK..x.......3.xp...f...\.k.<.\|7.data...xw....9.......9.............@....pdata..(-...`<......t;.............@..@.didat..@.....>.......=.............@....rsrc..........+Hwp.,...Nx0W...,8$...G....n.....3..d...f..:.\.k.<..\|w....@..B........................................................................................................................+......+H}p.,#..Nx0W...,8$..GK..w..w..

C:\Program Files\Common Files\microsoft shared\ClickToRun\officesvcmgrschedule.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	4980
Entropy (8bit):	7.078007026681616
Encrypted:	false
SSDEEP:	96:abWjaVXRHjdAYxdorV5qwVmj+q8zkdlYcwo86hx5vSUBZ3CXJEHDoOCp+1BO:aWa7D5dorrqwVmqq8zslYcwo845vrBF2
MD5:	AC6A7AF038F025C918AAED18FDAA04DF
SHA1:	AFB5F5D3E2BC8AC946A6B8801A30AC666F03D690
SHA-256:	0B07C782FBF9A9FC3572A7843B487DABE042AA86A39E3A3E68DF3BABE6A28BA6
SHA-512:	0EBA0C96970C8919A38CD589F6271CB0D9D61B5745D1859C9778B4C772D309B0B851F2D474102795148198D0CDCD43D2209B4FCAB4517B81F845429E8037100C
Malicious:	false
Preview:	..A.\.Y+..m.)66.`K...`;...X.,.OZ9....5.X..(`.?k..M.@.V.....2...T;.N..+..#.66~..K...`.........Zr...5.X..(`Q?&..M.@.V.....2..,T.....+..i.}64.uK..`}.....k..Zv..s5.X..%`.?k..M.@.V.....2..-TR...H+..e.f67.vK..`b....J.>.LZ8..45.X..2`.?w..M.@.V..8..2.\|T/...F+..r.}62.dK...`=.....h..Z)...W5.X.f`L?8..M.@.V.....2.qTD.N..+..,.86v.QK..`h....._.:.LZ9...e5.X.r`Z?8..M.@.V..W..2..JT].C..+..=.H65.qK...` ......m..Zx..25.X..f`#?b..M.@.V.....2..5T....N+..?..6J.%K..`r......}..Ze..-5.X..)`.?:..M.@.V..A..2../T.....+..e.d6).kK...`&.....a..Z7..<5.X..!`.?$..M.@.V..Y..2..0T]...H+..s.f63.jK...`r.....g..Zr....5.X..2`.?e..M.@.V..B..2../T]...@+..d.'6`.LK...`&........Zv..65.X..5`L?`..M.@.V..^..2..`T.....+..u.f60.uK...`~......{..Z7..95.X..(`.?w..M.@.V..]..2.7T....M+..o.f64.%K...`r.....k.^Zc..}5.X..(`.?c..M.@.V..Q..2..3T....U+..N.o6&.lK...`r.....z..Zv..85.X..)`L?o..M.@.V..[..2.5T..C.U+..!.m6!.qK...`r.....`..Zy..}5.X..%`.?v..M.@.V..D..2...T....@+..h.e6).qK...`!......o..Z7..<5

C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	87298
Entropy (8bit):	7.199040363074211
Encrypted:	false
SSDEEP:	1536:TQkCmgf1n0djCiiTaYAbpZrQbDFGGLGaS4hSm:TFCm0xmCzup3QAGLGN4hSm
MD5:	5E9FDC4FC39E6636DDF82B2240DF02D2
SHA1:	0E342410720A6049F2828B721B0E84600238AE01
SHA-256:	7AB764446130C5D106BE8A9C86591DE2C5A2132B2B1D7108BC9DF974C867CAB7
SHA-512:	3929F65536539C81FBEA3F8B30ABB3BD6E02D76CC99598E23ADDD989EDB8D1862CEE3B9AC478427DF165A23EBC192600D69C8E5F93C0C4BC83801B1CD90D1F65
Malicious:	false
Preview:	...Q.k..4n..}/6..i..&.......M.....!...]....cWn.y.DS9<..U.4.j........!..L.!This program cannot be run in DOS mode....$.......EGQ..&?..&?..&?.ZN;..&?.ZN<..&?..&>.k&?.ZN>..&?.ZN?..&?.ZN7.+&?.W..M..j .l...{....'..7.....M.....!...N]....cYv.g.DS9<..U.4>J.........4...................................................... .....`A........................................@1......\3..d....QBh..0>..Z.6..[.......o...Mu...!...]....cWn.y.DS9<..U.4.j.%............... ...............................text............................... ..`PAGE....O.......,.................. ..`...0.....r....7..w..&........M....!...o<...c.h.y..R9<..U...j............@....pdata.......P.......$..............@..@.rsrc........`.......,..............@..@.reloc.......p.......0............Q.k.I0n....6..i..&........M.....!...]....cWn.y.DS9<..U.4.j..................................................................................................................................Q.k..0n....6..i..&........M*.....!..

C:\Program Files\Common Files\microsoft shared\ClickToRun\policy.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1327762
Entropy (8bit):	7.034108243876747
Encrypted:	false
SSDEEP:	24576:LqyqbxyvEN62IsCpQ6nNj7bF9vIFeehy3bXUyRzQCTuWP7+AJjqAS1COac9d1:bvQFe0+bXHRzQCqMVqASII9d1
MD5:	238DEDFDC4B75E2F7F4047F374187885
SHA1:	293788532D92E331C140DF3EABAB1F6C688818A2
SHA-256:	9A9F68C3A5DE6846D1F8CF15308D64A39A3E1851A59FD746BF40243B8BB3FBCC
SHA-512:	4AF4E764683DB92F74D92C98A8FCA253153D7848F4163366B1125ECFFA1884C18C75028429F76B9D9B3486B552C87CE0CB9AAC61046779DD9998877B14A95E88
Malicious:	false
Preview:	....=.......r..'.x..qz^o.m..D._..@.f'N.G.1...3..'f..]:-.qq............!..L.!This program cannot be run in DOS mode....$........x............aC.....v-.....m......m......m......m.........=4.`..+).....3h.....h^.U..4....6.$.r..x.l...R...6.g.m/.....G.....m.....Rich............PE..d...S.:a.........." ........................................................@.......,s.=......0.'l.x..qz^/.}..D._..@.f'N.G.1...37C6f..]:..`qj.......4....@..........XE.......6......8....................>..(....[..8............ ..h...hW..`....................text...k........j.>........0.'l.x..qz>.i...%._OS.@.FN...1...3..'f..]:-.qq~....data....z.......b..................@....pdata.......@......................@..@.didat..(...........................@....rsrc....g.>..........'l.x..qz^/.m..D....n,..'N.q.1...3.-'f..N:-.qq>.......@..B.........................................................................................................................g.>........0.'l.x..qz^/.m..D._*..@.f'N

C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	983498
Entropy (8bit):	7.304534647795732
Encrypted:	false
SSDEEP:	24576:x3Pg8tGHDyHY1bcUjACwM0yVU6R+OW1YoMvZl2BbmQZ7gy03:5PglWHY1oUjACr/VU6RfKs72+3
MD5:	06D42A15C9A93DD03FB89E99C039C671
SHA1:	59C21D857FBBBD607E7FDA2755EF30C8858219C5
SHA-256:	8B7BE76767E1BBED81727E2FF25B9D3B73FE533A80F5D294DBB2EC8A7BFD149A
SHA-512:	6A9DCC7018870B9A68C4DBDFAC8918794653D72C0FCA3ACC26E95F13BC1058C383DF4ACE10C0537CE65218F4254E92A9FF02C33702EF681E13C9499AFCC10F98
Malicious:	false
Preview:	...#\..8...<...~.Wq.xx.\|lN........0.....\pI.lv.....&..x..n..........!..L.!This program cannot be run in DOS mode....$.......b...&.a.&.a.&.a./.....a.&.`..a..6..'.a.l..'.a.l....a.l..p.a.B...I$.{.T<K]3.U..f.V...-.K.......&Q)....\pI.lv.....&..x..o..PE..d...Q8.U.........." .........N......`........................................ ............`A..................................j#O..........^~.Wy.x8.\|dJ.....w0..t...NI.lf..!..&wHs..o..........................P...................H............................text............................... ..`.rdata...u.......i#_\.8..7..N~.W1.8.....N........>.....\pG.lv.....&..x.o...pdata..p....P......................@..@.rsrc...............................@..@.reloc..............................@..B..........j#_..8..7..N~.Wq.x8.\|lN........0.....\pI.lv.....&..x..o....................................................................................................................................j#_..8..7..N~.Wq.x8.\|lN........0.

C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	331458
Entropy (8bit):	6.875238774825072
Encrypted:	false
SSDEEP:	6144:YYF9Tc14de2gCWzSD0DX75kvZ9Q8S83by8O3i+FRXxnJ+xx3B7l9ZYuk5zXdTfVa:YYF1m+yB3i+DX1o/l5Yuk5zXNLE
MD5:	EC65F93AA623EDD991D85E1AF4EAB6DC
SHA1:	1B563C12130068FEA8AB6B01EA11A32F1CAE6A15
SHA-256:	715D93A6FE1E531E41DBD1B27AA9A69D6E6AAEDEA2870C5CD9C5F38FB5494DF8
SHA-512:	D439D4F600B858DB7481619561BEE9E788343F1A4B1E841D4EEA034D1C49C591096E078D6FE864F2FEF20E4D21A3DAA9B9EC97D4F811FDAA052E3D15FE3A8203
Malicious:	false
Preview:	m.......@\@.`7...A.......4bN..jV:+..,..../.ka.g.}.n...dx^PF?........!..L.!This program cannot be run in DOS mode....$.......d&.' G.t G.t G.t)?it0G.tL3.u&G.tL3.u:G.tL3.u(G.tL3.u$G.t.7.u'G.t.....TX..o....9.C.....p...1.oYT.....k..P..G....g.}.n...dxVQF?........PE..d....B._.........." .........l......0}.......................................0............`A........................ Ta.....D\@.......B.z.....0bb..jV:...(...8./J.ka...}"M...ax.KF?P...T...............................8............................................text...f........................... ..`.rdata...9`.....D"A.N....A......4b...x^J..,..B./.oa...}.j...dxVQF?....@....pdata... ......."..................@..@.rsrc...............................@..@.reloc..............................@..B Da.....D\@......A......4bN..jV:+..,..../.ka.g.}.n...dxVQF?................................................................................................................................ Da.....D\@......A......4bN..jV:+..,..

C:\Program Files\Common Files\microsoft shared\MSInfo\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	584370
Entropy (8bit):	6.985147209765909
Encrypted:	false
SSDEEP:	12288:eOTvCK+Oee8VqTID4zSGMmDK9f72s02k7Oyqv:eOTvF+Oee8VqTIEzSGMmDG7kHcv
MD5:	569D7624B1F3C9E87A1FDCF3F2A37160
SHA1:	A6F85846B9E257B7011AF2008338EE9DEDC07571
SHA-256:	CB04EF0E47F4F5623C653E397C8FF50D69E54B1071F9CCB29BAE5F6E6B6F952B
SHA-512:	EE0326A61A68FE57ADA2F89DA1B0B185098C3FBDEC83C1E633CE86D4662416C6037393BB0B66630DAB1C067A0A1D0F977868AA6B634D3BFCC7E8A6180635FFB9
Malicious:	false
Preview:	...}-.~!....+......W.Q......d.Y.........J.....883.T.#~e.0........!..L.!This program cannot be run in DOS mode....$.........c';..t;..t;..t2.t)..t]..t9..tW..u=..tW..u...tW..u1..tW..u8..tM.E.D........t.p;.... \.......i.D..s......E....<...5G-..VT..DRich;..t........PE..d.....:a..........".................@..........@..........................................`...................\.~-.~%...!......G.Q......d.........z.../....N.83...#.!.0............8....................b..(.......8...................Tj.......................text...[........................... ..`..(..L.~S...!4......WOS......d.Y...D...N...J......=3.x.#n..0............@....pdata...%.......&..................@..@.didat..x....@......................@....rsrc....e...P...f... ............L.>-.>.gg.N.......WAY......!l.Y........?J......883.T.#nd.0..................................................................................................................................L.~-.~%...!......W.Q......d.Y......

C:\Program Files\Common Files\microsoft shared\OFFICE16\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\Stationery\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\TextConv\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\Triedit\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\VGX\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\VSTO\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	166858
Entropy (8bit):	6.965553733256058
Encrypted:	false
SSDEEP:	3072:KkBT8q+sXGu9k/IWD6+ebo6vCDuyvGwW67EoNS9P:cqvXPEt6+UohDus7EpP
MD5:	024B9B0686C022221CF0F10556C4C912
SHA1:	0E4B5A2774B39FF5F29D9B9FF6140C07F8DBD8E6
SHA-256:	D0294CBB9D82C5EFC30BCC691295FD65DFB5170B6F018B515E282EE93B3C6A45
SHA-512:	609ABDAC97809A5656F56052BCB685539D3DC70B6056B841D002CCFBEFA1129B70DD83BE605BAE68576934D71A0DC0EA79187AB0C35C6A557A2B693014877AEF
Malicious:	false
Preview:	......_.7...}.w$.....y.?bx.l.1r...Z..,e......'...z4...I..._........!..L.!This program cannot be run in DOS mode....$.........&.].H.].H.].H.:h._.H.:h.\.H.Tf.X.H.2h.v.H.2h...H.2h.W.H........R.).:....}%.Y..%....$.$U..C<.D.@..A4I..zu....d\|...I..._........PE..d...6.<Z.........." ................T..........C..........................................@...........................\..._.7.....w.!.....!.=b..l.1..@..,...5...'...$`4...K.C._....................................................h............................text.............................. ..`.rdata...0\...^.......w......9.?b8.l.....Z...@...Y..'...X6...I..._....@....pdata.. ....p.......4..............@..@.rsrc...p............L..............@..@.reloc..V............h..............@..B..\..._.7.....w......9.?bx.l.1r...Z..,e......'...z4...I..._..................................................................................................................................\..._.7.....w......9.?bx.l.1r...Z..

C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	17362
Entropy (8bit):	6.874268977561389
Encrypted:	false
SSDEEP:	384:RONo0rdTYyjf60sXW++y5ZHAmaLPCWEN8:AaWVexVvAmiCf8
MD5:	A9046E2D6A4191BB6FCBA1E92EF84364
SHA1:	DFEE3CFFAC43349A2A0A28AECBEF7AC79E29AFB9
SHA-256:	AAF3053C9FD0CAB6345F23E468F8595477B76368D3C88E6CB53164E48250A652
SHA-512:	59EBC58DA999B3B95C983A27A682341AB34127F015E023F5464A3B2AF7B8FB54C86328C6530578593DFE781A5A9360E666E50589F3FFEA3485666E88DEEDAD8F
Malicious:	false
Preview:	:..^.rZ._E..E...7...4..gK"[..r..-....@..`........7.h..W...n..........!..L.!This program cannot be run in DOS mode....$.......Z.e..p...p...p.......p...p...p.......p.......p..."...p..."...p..%.v6..Q.[E...t......4..'K"[..r..h...vF............7wh..\.......................................................p............@.................................................@"..<....P..D...w..^.rZ.[m.."n.......4...k"[..r..-....@..`........7.h..W............... ...............................text............................... ..`.rdata....... ......................@..@.data.../..^.BZ.[G...`......4..'K"[..r{.]iu..@.n`........7.~..W..........@..@.rsrc...D....P......................@..@.reloc.......`.......&..............@..B........................................w..^.rZ.[E...t......4..'K"[..r..-....@..`........7.h..W.....*.................................................................................................................................w..^.rZ.[E...t......4..'K"[..r..-....@.

C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	22994
Entropy (8bit):	6.609100705368646
Encrypted:	false
SSDEEP:	384:r1dJbfxkt0ePZyKS1qW/3FE+Ao1D3JmWm/lIqW5BwC4fffFq/0bCfqMKrbiSocw:RjvOZNeVE+AoN3asBwCy4/fnG0cw
MD5:	DDECF9214B3B26401755B2209F703B4A
SHA1:	A41FD23BC65BFC1C941FAA96BC16768436373676
SHA-256:	BC631E758BE6BC4E1143554C76063E4D3236D7D5E83AA99115C54084FA293D66
SHA-512:	CEFCD57EA60AF817D58E59F49A9DCEFC9659222707AF13C0E1726E8002EF5C99CF7D672DC17D315A214647C9C71A9D35A0DD9526821B289FD25E81E592751CDF
Malicious:	false
Preview:	.R...@a3.....z...j.G......,m..W..r...N.}...O].C...Bkz/...#q.]........!..L.!This program cannot be run in DOS mode....$.........zlU..?U..?U..?\..?W..?:..?V..?U..?C..?:..?]..?:..?W..?2..?T..?z..@..u..M..o..jj.G......,m.VQ.a...N.}...O..c...Baz/....q.]......................................................@.................................................8"..<....P..P"...@......H6R.FZa3.v..[...J.G......,m..W..r...N.}...O].C...Bkz/....q.]. ...............................text............................... ..`.rdata....... ......................@..@.data...X....0..H.R..Ta3....W...jj.G...q.H...W.jr.....}...O]..C...Bkz/....q...rsrc...P"...P...$..................@..@.reloc...............<..............@..B................................................H.R..@a3....W...jj.G......,m..W..r...N.}...O].C...Bkz/..*..q.]................................................................................................................................H.R..@a3....W...jj.G......,m..W..r...N.}

C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	721
Entropy (8bit):	7.195727335381775
Encrypted:	false
SSDEEP:	12:95jB46A2axP+Ecy7K+T3K2TZvx5DmF9SJbKVQufrGo6NlfmjqGUEpy0j1FBLbl:b1/ixDf7Kv2px5E9SJWrr96bmGG1py0P
MD5:	6E6A2BC2AC3A201563C4B3FC501D5902
SHA1:	F2CBE3DA24AB3BCAE6C9E43E97F4D0CA7C8FC00F
SHA-256:	6B15625C4ED4BCE7DEF81260C75852ACC4DA8BAAB232484129A1439C5A353B82
SHA-512:	5F817860F15341B825961120823E164430FBBA1E4E411B4C638EB354763AD612B7A6E398B465EF627C935EB8B9CF485281C427DA828B2DF1AB007B16330EF403
Malicious:	false
Preview:	{._.9^z....s..Sus....5../d..W......G..!..,.e.ON.O.y.-...9."`...p.'....2..S~m^.....z{4..+.....SOg...f..2...-..f...yH.....gg...pnj....bT.G5...../.co:..L.....v~...r...f.M.h^.f...j......gg...pnj....dQ..+LT...+.tk:..H....hC[...V..f.\.@~.K.t.+...(.`J%..p.;...2.../x.....}.}b ..V.......t...f..o.E.rY.v.u.(...?..7)H..Z.;.Y.....Z\|rT...w..f3.............Q..d.G.rI.E.w.yH.....68'/>..</Application>.....'i....Z..tX.7......v].]..g. &YLj....h.,h.?...2l..#...y2.b...u.......x..&.%.~+#...1...?..z.m..K....'....s^...v.c.....K])..A.D....cb.....qSLJ{r..2..'....b.-O.Vjter.{tP..t..,...,~SA..R2E......n..............................................................................................vux2f891j9j.

C:\Program Files\Google\Chrome\Application\chrome.exe

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	2509970
Entropy (8bit):	7.300133002053801
Encrypted:	false
SSDEEP:	49152:636M759dz+kJ750kS48c/o9n2SUaxXHGAdLYlo1d:636+fziV48Ao9RUkXHuM
MD5:	825BA580B14C5F0DD74F41FCD7C033C8
SHA1:	BAAA75D428DAEFB68D81D8B9C9806B6B516DD2FE
SHA-256:	AC3A693076BE3F7A2050FA9D87BE4DA0A64E773BBBEF689AF292C5B634607E04
SHA-512:	96D79AFE0D3528527F4ACDF144CA730EC3F1428E5AE9C45C0F0D5E0535F0819CC5277378EADC50DC76A2917BE414E4EE7E5BA49B3F82CFB05E1E3A43F9F28FC7
Malicious:	false
Preview:	..q....]..D.X[..h..?...1.^.....'.Ds)wn...?...O.~....w.=.!.........!..L.!This program cannot be run in DOS mode.$..PE..d.....Ka.........."......R...........:.........@....................R......]..c.X_..m...=.e.q.......'.Ds)wn...?...O.~....w.U.!.............P.....".0.....!......,&.X.....'..$......8.......................(...0...0...........8...........`...................y.l....].._.XK..:..?...q.^.....'.DsIY.....?.u..O.....Kr.E\:.............@..@.data......... ..z.... .............@....pdata........!.......!.............@..@.00cfg..(.....".......!.........W........!.(7..h..?.'.q.^.p...'.Ds)wn...?....<.~....w.E.........!.............@...CPADinfo8.....".......!.............@..._RDATA........".......!.............@..@.rsrc...0.....".......!.W......]..D..[.....P...}.^.....'.BU)wn...?...O.~.A..w.E.!.................................................................................................................................W......]..D.X[..h..?...q.^.....'.Ds)

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1046674
Entropy (8bit):	7.225772793146061
Encrypted:	false
SSDEEP:	12288:bQU6JlS6XxoHhGzvMpK/OXjW51IMfbeidQKk32v7Z4Y72K8QxOROO3r9j+y7rq+I:4Hoh4MpK/O651je532vVR251rx12l
MD5:	0932F19604435B261295C8A5E87A9999
SHA1:	48D8A32CA80D7362525187562DCA94B0C6B23275
SHA-256:	15D203B83B45BF5E16037B53FC57DD7DA8D2B9612CBAB8FD68332637084644A5
SHA-512:	E78A2E0FA11E3514854762708A8E7270C7062012273158343C23EF92BDC8D92D44BC0DFAAF1A9AE839449FA4460A8014236AAE383BE3D5689D2F0DD9B1F67D5D
Malicious:	false
Preview:	cr..........oe...hH.....E....a..:...I....1V........h...E..........!..L.!This program cannot be run in DOS mode.$..PE..d.....Ka.........."......p...d...... +.........@....................+(y......c.oa..`.X....5.E....q..:...I....1V........h...E...)..Y...a).......p...........u......X...................................(...(...0...0...........0/..(............................\..........ou....D....E....a.......;..oa1V ..."...:...1..............@..@.data...@........t..................@....pdata...u.......v...:..............@..@.00cfg..(....@...................({.......oe...iH....G...4.a..:...I..[.1........ h...%......................@..@.rsrc........p......................@..@.reloc..............................@..B.........................({.........oe...hH....E....a..:...I....1V........h...E...................................................................................................................................({.........oe...hH....E....a..:..

C:\Program Files\Google\Chrome\Application\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Google\Chrome\Application\master_preferences

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	132374
Entropy (8bit):	7.1976839351455615
Encrypted:	false
SSDEEP:	3072:q7E7lyZHHIewjG3M1rMhQ4RuJ1f8yJBHy+y1gPZJ5sFUT:lWHIewjVMG4Ruf8yDySPb5XT
MD5:	2D26DC152E05A3F74F5923BEFEBE093F
SHA1:	D797474B9B313EBCC6685BF0C19D4F1E5DCE1137
SHA-256:	A464E31374E814048AF560C4D61300ECB75FAFDFB26BBA0F171AF0745982A9B2
SHA-512:	59FB8F609D911008175DFBBB04560F0D61CC1C804E6B85DC75F93D9E3B7144CA3B4271EAB7FDC90E55B909A1B9D70EEBD9027E01ABBCDB45302C9CD825293705
Malicious:	false
Preview:	+#-.d#Q..'.^.`.Yf....N..F\|...e).d..p.C..........\I.x.._UridquVut1dXZ39jn6oH7eyz\/uhlozOU12hrq5yZFervsSQHY+bmaGKjEhuRFZ16Q9\/wgwYSdZjYcAYFg8zSx6wLcDYeAQesJnFgqHx8PayPXjEMmMDY8zwBgMGzzo.....O.}....Q...XQ.......Y ...Be.FG...D.m..%u..G..=..kZ.l...EDdHdXYAnrDO5yKkX8ZdEFVTvqNm+m7vXDNGum7Xrq2rudrJ6KQvkd0Ztdu1prpY31Rm1jMWnlvvgsI5vPbtzB2CbYxBjJTfDomaeL8W8Wo4sDritZc6\/ZfrnTa+4269.....h<a......h.n;...._..B`....Fk.\|...W{3:.u..Y...L..X%......jkV5\/pa7fmNUwprRXwgbHf39NJKp5MWdC1k0LVEm2CTUEA2nw26vv6\/ffuv\/NzZ+K9GD6p6vXPU7plOu9vs9tJ2\/far1ayZc3dFoVyOzttmPb3c3Mvyv+301RxeM.....L4d...^.g..g.....y...Lw....dx......%L1.>...s..*..O^.C...fGXM3Sw2o2vx0XR+14PG\/HYZ923J6ddnprJ203DjvNdm9B4y7EZxnbfHbjTsbzUSnZpmB5I3+6+Pk3cvsL0sjyTnTedNq9rNPamXoraP1NXxgB5ej8YDrNCjjt674QT+....c.\|..x.a.^.WE....Z...u/...mOM#\...D8f.. x.DZ..S...-....udW0WPjWbyAaH2ttrGxGEJHpYm5uQSjtBCjcl98Bweh1xSLTbBxlqNBp3+rED2gWq3Ora3b7fr1FyuX2lere6ltdsOsrbZEoQxmO\/zQUp7ye6Mnxn1eTLe+VntoYynQi......c;T..&.c.q..r.....F..q/....q2:w..

C:\Program Files\MSBuild\Microsoft\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	DOS executable (COM, 0x8C-variant)
Category:	dropped
Size (bytes):	3228442
Entropy (8bit):	7.07046908566622
Encrypted:	false
SSDEEP:	49152:hF+5AaL5B0y6p0ZSCyJSf2sCHGvNQeHHqqtOVWQYhjWX1ttPXN37oYc/tjo8w:G5AC0ziJ/NwW5tQttPyYc/xDw
MD5:	EF2384173C8750BDB1F8F355F2886A3C
SHA1:	E07BE1541D4BCF225AA1CFFAFF26C260C68DAEF8
SHA-256:	C7483EE6B6487034DA3EAFB828BB897A2D33301385F57B7CAD58D3F642F89D2A
SHA-512:	B117D50D8F78FC5216F057D9F7F24411640FE1EF7261779DBF8C0E34C0DA38AFBD944DDCD1EBD8A181704B8163AC68D0490838B54D01454F164DF9754095549E
Malicious:	false
Preview:	.M..$..F..@y.A.........-.+v.N8......t..PA....JB...`Z...?@...........!..L.!This program cannot be run in DOS mode....$.......y..=...=...=..........Q../...Q..5...[.V.?....}..5....}..<.../..H.L.H..#y.='..9#+..}..g......s.\)..<l%q`...O....G.z..)o.f.W...m.....T.<...=.<.<......<...Rich=...........................PE..d....:a..........".......!..t.................@..............v...$..F.....A.......1y..+..N8......t..PA....JR...`Z...?....................,.).x.... 0..I......\o....0..E...p1..r.. ..8.....................).(.....".8.............!.......). .............w...$.>2....AVs......../v.N8......t..Pa..b=8&..`Z...?.},..B....!.............@..@.data.........,.......,.............@....pdata..\o.......p....-.............@..@.didat........0......8/...w...$..F......U...P....-.;F.N:.../..t..PA....JB...`.)..Mc....I... 0..J...>/.............@..@.reloc...r...p1..t....0.............@..B..........................................................w...$..F.....A........-.+v.N8......

C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	3228442
Entropy (8bit):	7.078630951756565
Encrypted:	false
SSDEEP:	98304:GhuKfIMMSfFaWEbFpMLzPrb69L3t682zX:G8KfIMMjWERpUTb6R3tl2zX
MD5:	F27B1274805B28C66BA6EF3E01E342E1
SHA1:	F92FBB63238BB2E1BB6358CF4767EFF73CF16F8C
SHA-256:	766F4BA2C49BFFBE80D06E5217345E0D4B0202D2A5C6D580BC8364604ABF0C83
SHA-512:	27DA60C5DED1D242B44D374AA990C1CA67A969A03FCC389CEEA08F33A91010E73844336F7F5D86883AE85DE94C5B3D82DA8E6D8D2399B9B0D90140D073C8CBDC
Malicious:	false
Preview:	...\z}.O..Jy..}R?...w.L..e....ZuG...a1.d.S.R..&...; .57..-...0.........!..L.!This program cannot be run in DOS mode....$.......y..=...=...=..........Q../...Q..5...[.V.?....}..5....}..<...VQ.V..d.....i>..K@..5...8~.H.1\,..5Q.C..B.Lt+..Y...3...S.....m.....T.<...=.<.<......<...Rich=...........................PE..d....:a..........".......!..t.................@..............d\y}.O..Ky.8}R..&.w.L...T.....uG...a1.d.S.R..&...; .57..-.].0.................,.).x.... 0..I......\o....0..E...p1..r.. .*.8.....................).(.....".8.............!.......). .............e\y}.O../.h8}R.t6.w.L..DD....ZuG...a1.d.S.r..F...ZT.57..&.]H...B....!.............@..@.data.........,.......,.............@....pdata..\o.......p....-.............@..@.didat........0......8/...e\y}.O..Jy\8}..SP#.L./.e....ZuE...]..d.S.R..&...;`.5w .^.>.0..I... 0..J...>/.............@..@.reloc...r...p1..t....0.............@..B..........................................................e\y}.O..Jy.8}R....w.L...e....ZuG...a1.

C:\Program Files\Microsoft Office\Office16\OSPP.VBS

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	105518
Entropy (8bit):	6.510650039799748
Encrypted:	false
SSDEEP:	768:sthDhN7jBOoJVRttSehvdJh0glRPxLoiKfkQhhUJAh2ohYkhap8vlrXfxzXdHcPE:cN9j1UIXcgJAhwdUrbzxzfbjui3uNL2
MD5:	7508727BFF272F1E6D5BA3B9FC4D77B1
SHA1:	42513DEA3DC133CC7D3A2ED3786362E651F34B9C
SHA-256:	B13F409B58F218458A4F517FF8E767EC5C92A34DCB73C35B82611DB9F152955E
SHA-512:	043F6BC30FDF85AA0E77C3FBCE4612B4EBA50B3F201F5338FAAAF79436EE18880367F95ADA9183FF520B6B3B949F2522293DE6EF0FB0E0129A9DA67891E40C96
Malicious:	false
Preview:	. .OpA..R..x[.l.2.6...q0Nl.C:.&.\|B.].....L]........cZ...x./////////////////////////////////////////////////////////////////////////////////////..'////////////////////////////////////////.L...-......4]..*Ao.j....,o.1..\|.g.s,..R.\7._.p..).1..>?...w. =0..CONST VALUE_ICON_WARNING =16..CONST wshYesNoDialog =4..CONST VAL.&.uMf..s.eO;..H/..e....#`.>..a.B..M.].2T.5`4..(.+......v.\| =64..CONST HKEY_LOCAL_MACHINE =&H80000002..CONST KEY_SET_VALUE =&H0002..CONST KEY.2.d[w..j.s;R..%N`.e....#`.>....x.m...2. L."z:..<.B...mw...w. =1..CONST OfficeAppId = "0ff1ce15-a989-479d-af46-f275c6370663"..CONST STR_SYS32PATH .C..."......;R..'T..,....P9Rj.Z`...Q..3.'8.$m"..6.0......ww. = "\Microsoft Office\Office16\OSPPREARM.EXE"..CONST STR_OSPPREARMPATH_DEBUG = "\Microsoft Office Debug\...Ug...i.fK ..W#n.......M.u>.r.....S.

C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	202370
Entropy (8bit):	7.105523309732114
Encrypted:	false
SSDEEP:	3072:QVydoPaJ1Q+wVfwEF38JEgT0oBQ6L0OWl8i2oZTutNWk1eZz+e8Wv4/W7WhgFcJ7:0CbhtLcl8b98k28WvJ2qjqA8ubrM
MD5:	464D7559C4924A158B47F682F415BC9A
SHA1:	BDCCDBBA558FBFB72BB08CD8580C622570CA30B3
SHA-256:	1C0DED75E136222B762A04A596945E6B425209B93D67B6E8FA51C28A4D56DB73
SHA-512:	C51F53267015DF7CBBC35979A0975EAC6AD621C4AE6B67E46FF60C759947855A45EE51B9656720C62841678F38950834AB6794863B288F880A3A035EAE4A127A
Malicious:	false
Preview:	...y[\|f.?3JG.........~7_O.~.?K.2P..tR.b.\|..{.\..D..'n.?)..............!..L.!This program cannot be run in DOS mode....$........O@..............V.......A......Z/......Z*......Z-......Z+........<^Wu....... .D.T......h.v>..h\|..Z\|80~.}GU....D..'n.?)..............PE..d.....:a.........."................. ..........@............................. ......t.....`..........................3..y[\|b.?3....o......~?.M.f.?K.2P..tR.b.~..b.\.eF.7bn.?9......ly..8...................PP..(.......8....................S.......................text...{........................... ..`.rdata....3..iY\|b.?3.N..o......~w_O.>.?..V1..tR...\|....\..D...l.?)..........@....pdata..............................@..@.didat..@...........................@....reloc..............................@..B.3..y[\|b.?3....o......~w_O.~.?K.2P..tR.b.\|..{.\..D..'n.?).......................................................................................................................................3..y[\|b.?3....o......~w_O.~.?K.2P..tR.

C:\Program Files\Microsoft Office\Office16\SLERROR.XML

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	36650
Entropy (8bit):	6.467523021490642
Encrypted:	false
SSDEEP:	768:gVIEsgk6y2xN4Bhb6p5IXYCM3KVC8LYFW:4IEsgk6Txwhb6p5IXYCM3J8Lf
MD5:	E7B5C57378C7829F34E7DDA0AD875046
SHA1:	4CDF6E14B2C23D87377FE2479131A4B44C43D971
SHA-256:	1CA917EA323D0DAE36754898C0189EA79514FED6CA70B0EB471F3CC2978DC60E
SHA-512:	F5B787F030B19295E46BC26FE4800AE0E9648646CCD4EA70B44B3753CB735DFEBF625A0B0D567BF30890AD5D86E3A35A6D4D6B450D02188DD0189837DB1E25BF
Malicious:	false
Preview:	...s..^....vOa.}...X..._... .B.w.r.h/.!mp..G...9.$F.GB.R...Q.the license is invalid.</err0xC004B001>..<err0xC004B002>The activation server determined that the license is invalid.</err0xC004...3Xi3...k~#.1..._........i.@.w.}Hr%..7z"<.A...$.3O.]O.....@.license is invalid.</err0xC004B003>..<err0xC004B004>The activation server determined that the license is invalid.</err0xC004B004..=..K....'.#.0.tO.........i.O.m.a.d2..7\|g.\...m.>J..S.....F.nse is invalid.</err0xC004B005>..<err0xC004B006>The activation server determined that the license is invalid.</err0xC004B006>..<...1.'.....$.G.`.AD..9......s.S.{.3.d0..&mfx.]..F9.3..FJ.......ould not connect to the activation server.</err0xC004B007>..<err0xC004B008>The activation server determined that the product cou..o.......gTe.q.D.P......0.c...-e.\|.. 8z....'V}.h..L......D.ion server determined that the license is invalid.</err0xC004B009>..<err0xC004B010>The activation server determined that require...t..W.....\|Vv.%.NS..o...... .D.x.f.en.

C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	827562
Entropy (8bit):	6.3201124102831825
Encrypted:	false
SSDEEP:	6144:KvqI/Z6fu4RbJvWN//sQ+PKCoYlYdj/c28nXn1VVYdB1pY4:mj
MD5:	D5CC8BB2D5A51BF00A5070AA00BBF361
SHA1:	0EBA93B3DB2EA8F3FAE8637F8DBCFCD5000B816E
SHA-256:	383924AADB7E93BACD4903A2648D229FC96AC3965675F364F825E5E7F13538D1
SHA-512:	121F89316CD1787F60E9BDDB55869452D0CA75C609721C488184294EF3A44479216E74FCD72FA734149C00D58DBC01A631A6549477CAEFDB4AF0D9EC757618C0
Malicious:	false
Preview:	.g..02?..F.0l.../9@...{\|YRm.........;..K..B......#-..U@.4...zrableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c..}Z.#.... ....4>G....ntFL.L...N...2..M..\H.....?b..W_.a=.vom/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher="..oi. 9..D.2.....1M.... 7..=B.......x..M.Ik.....Xk....8k..%-0016-0000-1000-0000000FF1CE" appv:VersionId="69547d97-58e2-45b7-992c-ed6e2cb22b62" />.. <Properties>.. <DisplayName>Microso..rt.55....%.....(N....{\|./.V........)..O..K.....t1..VU.x>.:PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescription..=..6/..H.dL..R86V...6KR\|....H.....;..y...I...../......2:..c:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <..7I.")..H.uV..x}x.....[pDti...V...u.

C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1912
Entropy (8bit):	7.711487886938864
Encrypted:	false
SSDEEP:	48:UiczHrfmfkrfw4lJL7PWrC8mG/IFczlgs+JUl8ma8:UiuHzmkzDBdyIuBgltB8
MD5:	0FDE2F9F3BDCB08B4D89C32646623CDE
SHA1:	D01E2FC8DA87D24698F614B3FFD1EF13460AD057
SHA-256:	D2B758FFF16E2C79071FCCD179D32A52D42C9E35FBADA1CB29BACFAA48962595
SHA-512:	FF7E8F54413F819A2928F1E7EF498E6B6C226024FCCEB893BCEECD6603EAA0299E26979967CDADB57181F67773EEB47B69D6ED4AE91D5C6E898A36F150A5962F
Malicious:	false
Preview:	h..+?M.`#.P./.....b^A..B.x.arp.y.L..".T,\|.d....ZH..\|u..Q..aC.D.{.b.f'.?..-...~M>....x.t&-.y.D..l..~bC>.....O.....3h...#.`J...x...{2.`B.y.....g]j....p.nyp.:.L.. .P(z.e.....A.....~w....!O.H^v.\.$p.~@.%.....}O-..J.f.8vs.-..X. .P(z.e.....A.....~w....!O.H^v.\.$p.~C.%.....}O-..J.f.8vs.-..[. .P(z.e.....A.....~w....!O.H^v.\.$p.~D.%.....}O-..-.(.Ksf./.H..L.I97.....I.....i...).2..kLE._.y4.+R.......`.-....&.6$1.u..].6..=zG<.....M....?<L.]\|.?...A&Y..?r.bA.x...DM>.?..a.K. 7b.+..?.p.M3d~..........`..Fx.n...A _..> .\|A.}...E_..1....4.pxs.).U..<..\|.j.....@.....x;1..>.\|C.QQX.J.h'.~E.g.....oBA..B..."7#.g.I..k.L9xs#...b....xv...).3..P.{._.n0.&..$.....k......(.Frp.).L..m...oD/....=....tu..."..&..Q7S`.l-....-....SdKj...g.m)..{..I.c.T0v:...G.....nf...8.`B.k.7.I.h0.?..'.....kIj...x.t-B.+.l..i.C9NR9.....E.....=%\.W-..Z.d.g9e.[0.,5.<.....2.n..Q.I.rAJ...S..z..Q..j....\.....n;q.Kl.]I.J.e.I.5O.oP.h.....{Il.k.f.wvd.f.Y..w..\|%.G....~.....~`..fF./..W.e.].b1.;..v...T]..@..N.^.pdj.5..G.>.k

C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	529160
Entropy (8bit):	6.44116990199148
Encrypted:	false
SSDEEP:	3072:f1A6A8t8WNtCej0K2s39ysOIhIUZO21lEtvMhN:f1A6ht8WNtCex7CX2KMhN
MD5:	0EF4CC4FE0C0B6B7DBF4D586E0FF315F
SHA1:	3046B2050EDBFEC17EC775D913DF9A1EAA4F8380
SHA-256:	9B64E219ACA39DA6FFDDBCAEC377513F3175FB6E7D168CDB27C3453A185456CF
SHA-512:	5CF39FB663CAB96F5E12373E692FBC4D5A56DB88E71F28DB3BA77FA28862988867315577C3DAA7C7DCBBA8F9A4EB351B1B6743E5CF7367991235F726F7799D41
Malicious:	false
Preview:	.?.X%.#.....D..t.a..$....~.x.*..K.......U@V....n.s0......."rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c......6..E.."..o.f..e....l.\|.g..........K.T...3.<y....Z....om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher="...6..%.....-..u.l..t.JZH....!.....]....^0V...%~5-...]....}-0018-0000-1000-0000000FF1CE" appv:VersionId="3d668649-c348-4c6f-a58f-2ffc5c040e30" />.. <Properties>.. <DisplayName>Microso...+..)..U..1...u.o..$..Tk..=.7..Y.........[...-RoB....C...bPublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescription..YD..3.....d...c.w..!.K..o.'.g...Z.........^.....\....L...;:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <..S...5.....~...&.#.......0z.n.x.....P.

C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.645945709445034
Encrypted:	false
SSDEEP:	24:zH9VE5v5MNNj+reAtUd6/gK/k/xORndK7Z/UUJ476Y0qWNQEbm/meklzEOhW1Pub:79Vmm7AyxKTRQsU4oqWTmB6Pz
MD5:	AF445AD40E7DB35190B28929ECECF27D
SHA1:	12340F6B38F14F2C058AFD3C7386E2DA92B77EFC
SHA-256:	5A049AFFEC8B7B44AA2B3BF1ABD9D7AD23938D1AD3E9421C7DF4D39159683ED6
SHA-512:	68BC11E8586824D54E53B70EB89A5331FCFF0B9FC4D84146BFC0ED7A034B29C5D0DC0632390A849046A5FD38BE11E4FE034A9C6EA6312F0EC8E7E2BC44D69A4B
Malicious:	false
Preview:	.._..M.Te.PI...V....S...L.Q&.G...a.W..-(.....D...q...~/.^..&...b.Ra.E....C......E.L.Dr.H.../..M.hr.....Q..."...kg.J...i.....Ot..[.......A.G.D.^-.@.....c.S..&)...._....8...{z.MK....\..6..Y...W.........R.."......c.S..&)...._....8...{z.MK....\..6..Z...W.........R.."......c.S..&)...._....8...{z.MK....\..6..]...W.......o...{'........J..>T...W....$...{}.KX......_.Mr.QK...K......K....p.L...u....lp.....S....l..9#..U..w.....4..X....Q.....#....c.......3.N..Ub......\|...m8..Q..&.....4.....[V.....?.E...@,........-O.<&....^...<...av.V..3...J.\a..\...P.....S...1..c.Z...(.O..Xo...\|........zc.]Y..2..._.Zv.\...@/...8.E...v&........=.oc........#...az..h..g...`.Xk.g...O.....U.J.S.]}.p... .W..]v....Y....4...ae.P.......I.\v.E........V.J.L.Dy......@..yu...[...[..().I.......e.ov.V,..M....B...}.B.......9..b.<&.....B...4....5..7.(...I.....I...k.....W.).R.G".......4..O."....`...#...6...E..5...].Vw.A....3A.....a...j.@0......}.h

C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1131578
Entropy (8bit):	6.253342926469899
Encrypted:	false
SSDEEP:	12288:5KZa/rX0SVmMQtAoUGIg3Xy7H/9ZBfCFZehEeu6ndHjOJ0YOhdwQOkkfW+EI+dLi:WlWLC
MD5:	2F6E908F81466BB09A02236C9237193B
SHA1:	35337192D7446E9188E07AECCE4391FA1F572FCC
SHA-256:	BB130CFD5020A965211DE6D80BC380ACAA29A16AAD4254AAB8992089AFD0F32B
SHA-512:	E6097D9BEF1C1BC317473A2FA7DA24988EA30019E1C9A802DB470B0E8E3571F2C9067074C004E9032DC8B97FC69AC75218F9AB4AD9CADEA8A652AABA25AF45CD
Malicious:	false
Preview:	...p.Tz..%.jjuC.WH1,/.`.}..$.h4.+p...L..I...K.>.,h,.....l.....rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.cB^..P.A>.Nq..`zB.PO.=C.u.b..}.ky.{..F.E..O.....&.\|50.....i.....om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher="n}..E.Rc..$..[~^._E3tC.;.>.s.)?.x0.K....O...;.-.z#W....+.U..-001A-0000-1000-0000000FF1CE" appv:VersionId="2592a2c8-c13a-4283-854e-e349101db440" />.. <Properties>.. <DisplayName>MicrosoKG..F.^r.^q.."_E.FF<0/.`.0.g.;)..u...^..M..V../.\|+{....h.....PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescription.}.D.Dr..0HJbu..X^8;..1.o..1.Zy..P...L..{..F..>.r( ....:.....:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <}A..E.Bx..4YP3.&...}u..@.`..5.rf.t6.I...

C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	796114
Entropy (8bit):	6.322157144630439
Encrypted:	false
SSDEEP:	6144:52hy+EQifEoeElhu5nX5EPEUiECPgiNOz+mOldc:Qhy+EQifEoeElSX5EPEfEwW+mOldc
MD5:	1DAF3EE5722827EF8AAB4242CDE7D4AD
SHA1:	DA6DDF8E29E7C1469CCECD6E90EBF5F2C9759C45
SHA-256:	006273EA3C6E9A87F71ABB8A3F7F240CA975DE1CFC830F7F68F2D673039D36D1
SHA-512:	5DA7F1D617919CB66FD7D3BF032C20F928109A85E59FE9E59F277C136D7F5AE4E83E92FFBA99B8DCBA2E3D5F87983829F6C8037FB1752560CB717BF0F12AD4BE
Malicious:	false
Preview:	.ICm.'.(.W..E.~G.?].u..~eR..=W.(..N!..Q..p....$._IU8...@,.].RrableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c\..0.6.l....#.qF.8Z.d..kmM..dS..\|..j..U..{.....?..U.q...Ey.N.^om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher="p....5.1.U..,.uZ.7P.-..%....j...$..g.....1.....3..2.%.... ....-001B-0000-1000-0000000FF1CE" appv:VersionId="5d489fe2-da5e-4831-b645-476514b60ccc" />.. <Properties>.. <DisplayName>MicrosoU.... . ....0.TA..S.i..~e..~...6..\;..I...........IJ...D`.^..PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescription...q.#. .Y..e.~..0K.b..//@..(...z.._4.F..$.....;..Ez......J.K:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <c..#.7..Y.....".~..,..^iO..,A..d..e..n

C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.686969453416251
Encrypted:	false
SSDEEP:	24:roGlATiuiYQUcg/tVyxIs8/8ZzNTrplvGiY+lcGezAd1ZN1:EGlEtcglgSMNTrLuitcId1v1
MD5:	A9E8E9649C4674DAA8AA0D412162221E
SHA1:	58FB89E505D161B248622CDB425099B26FE93A2E
SHA-256:	6A93F6D2A9D215B8B59C6904DB6A29FF80BF645B8F9AC70D4AF720BC4B899F5F
SHA-512:	5F8B5E3EED55F7F83D9306C0F0D34BAA81C1997E566531641E3F44360E4A9F6600089752A3F1D3FC7C666E86AE7C5FB3E094ABA718BF419CF8B15E3314CE1B96
Malicious:	false
Preview:	?y...n...".@.C....r.h.(q.g.+.&..r......R...o.^..u I..#b.1...l.6A...7.j.^........-.(`.3.$.g..h........H...z...X&oT..kD.0...m.> ...h.9........Y../. }.l.,.7..9...........t...T<"K..vM.q...!.#.....v.&.L.......`.6c.c.f.v.R9...........t...T<"K..vM.q...!.#.....v.&.L.......`.6c.c.f.v.Q9...........t...T<"K..vM.q...!.#.....v.&.L.........x,.f.x....$...........\|.R.i #U..qN.b..3.6\|...#.).H...U...#.v!.1. .u.W4........"...x...]hc.OY/..o...>.."...j.9.....GX...K..U.".f.1.5a......P... ....x']K.4..g...6.f"...!.0......WG...-.d@.m.s.3..w.......6...u...X8$.2.zY.,.....5i...v.5.i....r.h.U..".6....h...........W.....$J..oN.c..l.:\|.....y.L.....V1..-.x,.g.u....m.........6...Z'(I..vE.R.....oC.....z._......Y..".7w.<...g.C8.......$...r...}02Z..i_.0..a.7j...7.`.C......Y..".(`.8.f....g...........p...4_a._H%J./..~..F..$.q....KG]..{..`.T.x.5..A.......]...i...P02.rb9......{.0j....g.)......._..A.6w.c.s.e..).......R...K...L'"\.V.!....k.6~...3.z. ....WTs.d..u.q.y.y.M6...

C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1772
Entropy (8bit):	7.686229506066421
Encrypted:	false
SSDEEP:	48:bGoQoNw9ttoix6jRYh/jvovb3ndD6ncZKYsC:bl5Ettoi6+h7ovb3qU5
MD5:	6A27D7F88DB1A654B934334CB2221EDA
SHA1:	08F19D0F2D1142F11DC1A6570FDB67194237EC29
SHA-256:	E5BC6AA3D54CE4117C17265F284BE6CC6D4C9B4E3EA9E570397689E9E739B7BE
SHA-512:	89AEE303EA1D8FCB04DBB0E8A9003E66E5C3321CF8680E47FEF2C519600617DFBD68FAF79182A0CD6301FC42C1631600EB0A426698A24055E790B46D0A9225C5
Malicious:	false
Preview:	.]...[....].n.].3b..)..A"..#.......4.:.....fi....\.c.z...s.L....t....H.D.@.cb..:.P.g..2......z..h.]..(6.....0.g...g.J...............,b....XeU./........6.>.....dq....@..x...`..Q....J........R.(e..8.^T..1.......6.>.....dq....@..x...`..Q....J........R.(e..8.^T..1.......6.>.....dq....@..x...`..Q....J........R.(e..8.@!MU.~......Z./....bk....N.6.f...f..}....I....\...V.2j..q.O.iE.s....... ..+.Y...fz....'.~.3....$.................q3..\|.Nj.D.........f.%.`..a\|O...W.n.i....'.........Y.....w3..c.s&gU...........j.....nj.... ...4...{.X....\........w.2s..5..A"K.H......}./.m..kx........y...p..n....I....Q.W.R..b..r.t.gU.~........{....Z..b}E....1.z.........v....j.T.A.$g..<...h9.%......u.<.h..Wx......&.i...}....._....H.N.].$m..>...h..2....../.L..ni....P.I.*....d......s....[._...3v..c..\1O.2......l..G....Wk......&.4....(.M...._........$p..>......%.......a..j....'%V.....1.o....4..n....K....L.T.>.a#..p.-a...'.......(..

C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	2658
Entropy (8bit):	7.767029658576934
Encrypted:	false
SSDEEP:	48:pD50tWoPB1yYKbWSYnWZJ33EF+GpvJf/vuSrVSrtjGR9j2AH5:RwRWYngUHpvtuSrbTKAH5
MD5:	4038FD6105A58DBC853FF2D11ACA467A
SHA1:	6FECCE612E7B37C206C858DB494132620DB3B263
SHA-256:	CA5545319EE8F24ADD92E467BCA2B27D711309CFF76D27FF9B789BE200D5828E
SHA-512:	3168E7288DBB9D3031033573F493F5FC7CA52B882AB336449F61DCFFAD2D07237668712DC31C71AC466622514D97EA059FFA15D87AA62B3A25F14525A370E9D6
Malicious:	false
Preview:	..'S.o8 D.'....n!.#.k....>T4..z........W..!..p....Nf.#....B.7?...m>$P.f6..>!.?...^.>E!F.u........I...;..s..Q..5..:....C.1p....m#1[.5e...q!.&.@..\T6X;..}m........Q..r..e..G../.<......3...z\|s..7z...u&.<...... Fm..7z..G.....Q..r..e..G../.<......3...z\|s..4z...u&.<...... Fm..7z..D.....Q..r..e..G../.<......3...z\|s..3z...u&.<...tTn....)x.........r..v....<3.:.........=.i!7F.%u...o).!X..PD`.cD.q"..B....Q...Q..k..Q..{..c......hn.^..<gq`.6e...,p..U...8E.puW.7\|.. ....O...#..f....Xk..g...M.h<....8cx..3d....s.oJ..^Tre%.."~..........E..p..M..+......._.#. .e0$..2i...o0...k...JC?wW.g0........S...q..y..Y.R..6.......+...d63g.t%...R!.[(.^Tn....$~......D...w..<..Q..4.'...!.e~.O..c4...b&...y$.%.@..Q8!R8I.M,..V........W..c..S.(#..!....C.{..O..03J.s<...y...@..Q.>E!M.7\|.......e...s..t..Z.aL..s....\.......b.3L.B-...n5.sJD...N.E'!.)\.......+.....o..F..#..^....~.61.....mL).'u...y3.:.F..2. R".."1...........!../..G..4. .......,...y:2J.b&...<`.oYj.....P%..(b..X...

C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	2658
Entropy (8bit):	7.739918212141261
Encrypted:	false
SSDEEP:	48:2OMQ3tBt828O+9QgfyQYI7CYZbWza3tMV4OCDJfu3UlvC6uMntdqJTwF9XN:TtBt82h+9QgfyQYJY0eMyn1u3/Kntdki
MD5:	2919C2AFA579ECF56D1F943CCD2ADEDD
SHA1:	E196A4823BD8437709318B0916FB4788BA8E27ED
SHA-256:	0DD0905D0FAB7C28D9A09B1FF7B5B4B6E3250F25896A624F6D76741181F05C27
SHA-512:	D6B202F7258463A806B56A0743CD47325CAF5DCC6A1DC9C0148D1C09DD186BA142AA4042E98FFAC7EB11E52878844400929E683752E1880FAFCE0E2915BC0F2D
Malicious:	false
Preview:	...BV'..U...K..... kf.......&....>{..%].]..S..oI0.l..s..]A6......c...Q....I.....3.)......Z{..J.#aA.h...._I1.l\i.3.<..H..>...T/.ki..D...........#@t......&.V..80..!Y.V...}.zR`.p.q..X..9....c.v6...Q...A.....1.'.......%.A[..0..!Y.V...}.zR`.p.q..X..9....c.v6...Q...A.....1.'.......%.A[.\|0..!Y.V...}.zR`.p.q..X..9....c.v6...Q...A.....1.9....X..0.C..7-a.8H.N.J.{.iZe.~.p..X..?..4q,c5..B...z....x.6....U.Xg..X.z=..uL....#..t^f....0.T.MO}...J\|O@k\.. .........u.7...!.K4.G...h].<B.%..Q(.).d.=.. ...VK\|....zO5kY..U...J......j......4..%.E..+~.._..L..7w.oS`...w.)B.."....l1` ..QA.........<kf....n.Ku..:.,aF.=H.(.\.r.fq`.;..w..Y..)......o5..F%...@.....{(.....X..&.E..:d@.k....].{.#.E.-.{..B..s...Zl^:...[_...I......5@`......UX..J.n1N.%[.-._%N.\|T`.;.a..B..$...4#^b#..F....C......7@c......Q..G<./nD.2H...L.w.kVn.`..2.D.G.=...;<.P...F....X....jDw......=..g..-HW.k .L..\N.pOd..a.i![_q....9.e#..9k.........7Fb......2..H. Z.w..R.%S>.0md.1.q...vum...).c7..G..........yjT.......<.YT.`?...

C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1606
Entropy (8bit):	7.6723008894141875
Encrypted:	false
SSDEEP:	24:jUfTUrURwLCdAF73X5pGLbKJU4LaSOha4lIMukhtT78fRH9eELuq:oAFCdAFDX4CMdxCH9hLuq
MD5:	5538043F66A4941A1830021AE9C18A09
SHA1:	DC4156539418AD122C28BEC06DD06D72AC8AB304
SHA-256:	8AEB00CAB17157C193D22497AA705A6D1CD9C76587224C0A36B6A0B74BCF8E36
SHA-512:	D1C4EA0936B8B9F39BCE9F64E0DD72DE3A1915678D7E90E17863E60757FDC834F6A3869D66700F25FD847B92CF7392BA5987D85D0D6D831C01B3CC2A068705E3
Malicious:	false
Preview:	x-...`:W..;...+.m..K[......$.@I....&........\|9..\$.}x......%..7....1O8Q.....6.=..WH.....5.......;........=#P._1T6'.........>.~.9.8L..q..Au.r..NX.....(.KI.Q.. .......bj..I?] d.........;..2.$q/.M.o...$.v..TJ......6.DJ.F..g.......bj..I?] d.........;..2.$q/.M.o...$.v..TJ......6.DJ.F..d.......bj..I?] d.........;..2.$q/.M.o...$.v..TJ.....y.A_.D../....^..(j..Z7Xqj.........z.. .1r<N..:..& .l..I......t.......b........wI..G3[6......\..h..-..,i.O.s..@u./............[.@..........p;L..3_1......X..o..(.g,;...<...r...........JJ.B..3...C..q]..\>]...........7..=.2g0_..o.._..l..FG.....O.......4.......>i..U.]>/..........w....=r1Y..7..$.Q..B.....y.@I.B.."......?o...}x69.........R..=.hM6[......7.z.MN......"..7....v.....Y..=O/.O9]4/........6..r.0d_.....+.z..BL......5..{.@..7....'...k..X;S=t...........m..H7l..=..{.m.........5.ss.`..5....i..q6/.C"Y!>......L..=..h.7d.r.~..Py.z..RL......".D]....8.....L..G9_...Y %....f..d..x.1p,U....NH.?.......... .VS.^..x....

C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	8289
Entropy (8bit):	6.6663129040677696
Encrypted:	false
SSDEEP:	192:MURB2t0gQHZrmOrmZzag920z9cc9OIvtCt/Rhj98XZR8fwph8L3uMxa:RB2t0B5eZzag920z9cc9OuCt/Rhj98JL
MD5:	DDCAD7F3A4707CB2A1BA25B68E2233FC
SHA1:	B2B60FFC4BA95228D659622AEB69B6219DEA04E5
SHA-256:	51B73E16CB539BA3E2F19B9AC99B10C57E4EDC3C73B3361219D85CF4AA151FA4
SHA-512:	07D0C71DEBF47055AE5ABF47F1CAF530EF06040E32B1F0CBC063191B456EE0266853E2A4D8AE0EA37CE61873192B7CC93A28E1585E9C665DDAFEA33C68D0C1D1
Malicious:	false
Preview:	=...,.c.&..3.K.o..)<LY.p...I....[.VG9...C......tX..~.?!\|.....rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c.J....v..q+.U.D.t.6- ..x..........;....H.....$..M7.=>y.)...om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher=".i....e..$~.Z.@.n.+d .V;Z..........-........."..Dc.va;..Y..-006E-0409-1000-0000000FF1CE" appv:VersionId="5374d668-f01e-457c-86ff-4d8260c9d888" />.. <Properties>.. <DisplayName>Microso.S....i.a+.F.a.n.$ LY.pT......j.D]p...6.I...$.....<4x....PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescription.i....s.(j...KLx. +g\\:...\...l.GRr.....Y.....-T.oq*.....:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <.U...u.(n...(f=..eeMk-\|...X........%..

C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	66640
Entropy (8bit):	6.529938776168638
Encrypted:	false
SSDEEP:	768:gwi0y0+9j9P0OV30Hc/9U+90FOjsJ5/JID9PDl0CN0UWa9AJ70v4s9DRCMGTH//a:gwAutcG80QWLbsYXqdag6bvRnYY6H
MD5:	FC39D4285A9A21CA4A9F2C55BEAAEAD9
SHA1:	A986B3706C728BE7266A228B5F97846318E2DDA4
SHA-256:	C3AB62E80E4FB5A27624B39D0D1B805B7D113901BEC622000C2268EC37240C44
SHA-512:	863CBBC7B9649A1E8D5CB11A97961DC7B3324F5FBFDE9E0BE2082C61ED6E6CC01C1714A26C4191AC80EA8617DDDAD1A670C26304A59BAE35B6BBDF6FAD77B413
Malicious:	false
Preview:	.t..#R..r....y..l..%..../..s@oq..p.9..O..s.......D[8'.T:....rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c-....C.N!..s..w..:.....1.wC"%Z.1_;..K..r.......X.q%,K?.....om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher=".....@..e....H..m..'....q..%.d}Y.4R-@.^..+.......?.%dg.}.....-00A1-0000-1000-0000000FF1CE" appv:VersionId="1511c4a6-4934-45f7-8895-fc34334ccc20" />.. <Properties>.. <DisplayName>Microso$....U..v..1..m..(.....R..6.ro;.b.p..Z..4........GJ#-A>.....PublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescription\|...V..a....q..{..,....../..,r"#=.a.r..Z..........Ht.f~.l....:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <.....B..`.... .>.Hi.........eZ==U..P%M.

C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.675962492035193
Encrypted:	false
SSDEEP:	24:UsiodTuj8/Rhk98J1aqhwPbJSQHvvNLB9PZ4qNnLcnv5nvAnd5yLjcWozShBt5pr:UsLPapJSQPVLB9PmqLmYnd54nb2I
MD5:	EAEC8E778EAC88FBB31D347185C2D90D
SHA1:	11715F819A6C09652BAFAF1EDC1968D9EF1542BF
SHA-256:	E0D2770EA669AFA0A932B7ECDAA1234342CEF090AE213761D92E78B14F3A7CD5
SHA-512:	09F159D175CB2CF037D989B84DD3C3FCEB4DA741A684CB9DFCF02245DD100A110F03A26AE7ACADA981D5AA0E1F42C7CD65F5398D04B12FB508DF8174A2AE5B09
Malicious:	false
Preview:	.......S._.!O..F.b..>gBc<}.....%8.o~(..\|.v....=[/..._N.Cvh..b..(.....U.J..M....p..A(.&.}.W.%y.rdf.C..3...bX:.N....^o}...c..g.....H...X..Y.n...u[$ou.....f).i5..x.}....%N4.X....Aim..."..$K.........GE..].e..R&Wk#c.....qh..5..x.}....%N4.X....Aim..."..$K.........GE..].e..R&Wk#c.....qh.-5*..x.}....%N4.X....Aim..."..$K.........GE..].e..R8".o-.....s0.f(F..i.e...?]<...-.._om...1^..Y....J.^.H~..G.o.R7.(.#..K.)k.+8<.^m.7.....@8.N..S..6/..A<L.yT.......X....0..@6i@~N.....w/.Imz..c......z.l...MC.V1\|...:J.qW...[....\N...."..N.%&o1....u-.z{6.t,.g...>[5.R.....Kw......=D....[....T...G.l..>gBcq....Y.;..}da..i.....,R..F.C<.@cl...0S.<.....].S..D..z.m..}..&o-.....u0.kag.@^.4...).v.N....Crw..O.v.iD...._..h..M..Q.....a.).b.t.'y.?4i..z.....,H2.L.9..Ptw...c.......[.J..G..Q.t...b.).}.8.w..~kc..i."...=_0.E.pd..&>..\|........h.Y..\..F.e...v_puL..0.W+.\|Mp.@..g...?D).Y.........M^..&..........H...Q.o...c.J.c....:{.q%}.\,.y..q...X....Vu ..Q,@.;.....Q.N...... ..?Ubo![....ig.1:4.1

C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	401019
Entropy (8bit):	6.314002533697067
Encrypted:	false
SSDEEP:	1536:q+8Qnj4iff0+e3EIF7zXJEfZ5yUoGBMC2fbi5N+EU/OTnm61GbdHqMBQBJhqELN4:j8Q5AdEW9kjm/HDBJBEhVe
MD5:	3C0268AE0D37BFEB33FED26056B56B96
SHA1:	84E255199C323C980AD70D7A5005E3355FFA71FC
SHA-256:	B00B4B18E5DD663D8B3FB85A61C457483D9A1BD4623B5A2681C01D2ED7FB9BE4
SHA-512:	8006DA0916B3D7A9E649017E07B1F18970176D4876CCA3A4AC3689BCA455C892E3C0DA61F0C6D822151E1EE969A0CF4C3242AEE5C5346648C4AD109934EFEF13
Malicious:	false
Preview:	...F.....).C\.exv.nu.y....sd.....CD..A../..H......\|b;.hh....1rableNamespaces="appv1.1 appv1.2" xmlns="http://schemas.microsoft.com/appx/2010/manifest" xmlns:appv="http://schemas.microsoft.c..1......~..%V.dcq....l....`.......F..E....J......3+9.wm.Q=om/appv/2013/manifest" xmlns:appv1.2="http://schemas.microsoft.com/appv/2014/manifest">.. <Identity Name="Reserved" Publisher=",.#(....+.m.xy~..6..".V..$2P.....P..P..w..H.....x:.x.(/...On-00C1-0000-1000-0000000FF1CE" appv:VersionId="800e0520-c074-4e45-b0d3-7136cbf439f1" />.. <Properties>.. <DisplayName>Microso..>5....n..6..cyg.ru.y.X..0!B....Y...T..hK.E.....T`.?.}l.CqPublisherDisplayName>.. <Description>Reserved</Description>.. <Logo>Reserved.jpeg</Logo>.. <appv:AppVPackageDescriptionQ.qZ....'..cT.oy.y^.(....f;#.....V...T..r[.@......SHz.8>....(:AppVInProcExt>true</appv:AppVInProcExt>.. </Properties>.. <Resources>.. <Resource Language="en-us" />.. </Resources>.. <?.{.....'..y...7..7t.Y....br.....X..

C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1772
Entropy (8bit):	7.682281668808482
Encrypted:	false
SSDEEP:	48:xCt/C+gCnw2gJ0ycxSUrhAb975TCBxq1C:klUpJ0iS
MD5:	4B29F6E3826A781E40FF1521501449E3
SHA1:	40063AE1CE00F307E782808F7FFC5C1D762BCCF4
SHA-256:	ED1E8058DD75395032540AD0F7A072B0A0D2F57D99A0E58862480F6609D1E107
SHA-512:	471C1DF4CC6C61A7154BC361561BD9D5048D8DA6C15A038EFDA40CB6C19A1F50F42198351E4525954AFE05F560EFA3936DBE19A6C555D9A523536AA7614CCA2B
Malicious:	false
Preview:	..........Zw....B.....EFU...........'Z..=ZU`.#..j8....... nk..........]....P......TU.....T......uDRH\|@.?.6..5{}Z......)h$........PH.....N.......]..........#\..#.Wx.8..vwg........,sgQ......XNJ.....E.....MYK....T.EP....#\..#.Wx.8..vwg........,sgQ......XNI.....E.....MYK....T.EP....#\..#.Wx.8..vwg........,sgQ......XNN.....E...........J......2..ni.Qb.0..xJ{........m_DC........X.....O............FN.....6\VJ6Us.4...~3V.E....1:N.....QRK...W....f.f...T..D....8BoX1X.(.3..ky#B......w13G.......NI_.................A.......w...0>]c.9...{c....... z~^......HNO.....L.....E.(......$.....2^bU..Xq....=$\........`L........,..N....M..........G.........IUY~.Qt.z..+y\|........E<^...V-.M..........yJ.....T^....!.gL\|,dq.>..=^k.......!"D......W.....T.....TU...T.".....2hCOo.]`.<..f..T.T..9&K.......?F.....E.....V.d....J........Z&..0Udb.%..,sk..~...oe.......b_Z......O....lTK....A.V......w..1.Z.,....7o\|...J....sLx........M...G......I[s....K.JH.....

C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1606
Entropy (8bit):	7.664984517163617
Encrypted:	false
SSDEEP:	24:BSsHvTmXTVPyVOhjVLt076zP7Jkh1GhAEK/vjxnTVRjCLqnvT0XPlnxJxtAzQWLs:BS47m8M0W5TWXjCLqn70fRxnEQgbI
MD5:	1C5E1F8A6F44C1ABF51B6CDEFFC6004C
SHA1:	5184064306AD58798571273A9D36302A5ED4FF83
SHA-256:	B4EAD1E601110D889A902F6D6956C3BCE1EEF58B21A6658786DD5962134FC2A5
SHA-512:	31FFA627C69B4BABEFDFB911D44CBC3A100DE67515EBB4D76AC372C2C6CFA303C175A97CC5F2395CD97416F00482C066B142DE67B4A81CB6C0986612D69D93EC
Malicious:	false
Preview:	....@o/....Yn.t..`j..%..t .mB.)2..T.V..fW......$Xm3x..A...i..R.T06.u@-.....D.i...rv.j..f .x..&2..I...C4I...'M4x'.K....!<.S.R.7.}!-....K.....lo..7..'(.bI..q..R.T..bQ.....1C=nd.QC...<5...I<{.`~:..Z.I..{..gu.d..k>.4F.df.X..T..bQ.....1C=nd.QC...<5...I<{.`~:..Z.J..{..gu.d..k>.4F.df.X..T..bQ.....1C=nd.QC...<5...I<{.`~:..Z.M..{..gu.z..'p.GC.zd..].8..s......."K8?j.MB...;6...e.i.u})....[.....mh..u..7~.:..">.F..B.^wQ....?O;x....ZF.ec....ae.%#\|..S.H.....26..t..6..,..d`.Lr....yO.....f.m.r..BR..~g....37."#}..S.A..~... &..I..'l.\|H.qb..A.H.t6......$B=d..UE];.0!.O.@%t.vh%..J.L..^..ng..%..9]....4,..F....sS.....-`=p/.jE...%6...v$6.y}$.....W.{..oc..N..'p.JB.wb..P...@DD......h..x9.JI...<=.1..qt.,B#..T..T.h..,l..#..K?.a...0.V.....`......7E=z/.]S...#'.S...;.tk?.....N.t...vc.. ..f .x..d`.&E....se...... G3st.2.CV.o2.L...$.FG"....<_.$..g:..4..=..~q.z@..G...@.+.....;^9o>.]S]{.ss.n.U>!.sk?..`.Y..&.ms..!.f>.{F.q-..J...\6......{\|9n%.JC...^Y...v#1.u.9.....T....."&.....i..\|T.{~.@..J.1

C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	2515
Entropy (8bit):	7.765563152292819
Encrypted:	false
SSDEEP:	48:VnuoKBGxId9nkAeYpM46v9NaxoqKATLuMQXCVurjerx5SOYceU/:goCGxIdrQ6fTSSooTvem
MD5:	A02697130BB12BA93475794D926813C3
SHA1:	89D1DEC29384ED05020873EB872F38D6AAAA97F4
SHA-256:	96BEA09B75CBAEFB1A6AECF394BD2D886F48FE60C03A1483373A1294E1ACA8F6
SHA-512:	8FEB6C058A8FA3008DFDF679609CFDA95E0D921E407D411E5C1E205D77A783DA412FCC3AB6486C5D4388E031E331F506F7EBF45821BD51C36A6507926BCD02C3
Malicious:	false
Preview:	.A..S`/.?%..O...=.#B ..x9.w6.tC....i.x.ucr...y#....=`.H....^B...6Qf+.d..R.../.0=o..j9.bb.{C...'.5.k&(.& ..@..n/.Q..Y..X....WQ{>.u7.S..1. i2..+1.x=.s.....k.\|.shs...a6..V..tb.W..P..CN...F$\|Zk5..@...:.2.a..g'..2.9..E..k.\|.shs...a6..V..tb.W..P..CN...F$\|Zk6..@...:.2.a..g'..2.9..E..k.\|.shs...a6..V..tb.W..P..CN...F$\|Zk1..@...:.2....+i.]7.'.......e.>p....{%.....hc.Q..S..om...Uy8.>'.4D...0.{.p..;g. `..O.[..}O(.s"...j8..@.. #.............U.;~Zw4.R....oWv<q..:..6s.9..Q.;.a.m.8...jc....0d.........A...U.o~Zm7..C...}Gi2L..+u.f<.,....w`..#r\|...z#..\..pd.u..D..JW...Yh+Jk0.Me...3.?B ..5D.4s.i]... .`.q.5...h..H..Od.]..S...\|V....Xn<.3v..@...2.x.K..+i.P6.....&.6.f!9...mo..@..oh.L..X........4_l!T.`..S...q.6i&..G&.{m.CA.K..(.x.9.,...h0..B..xr.J..B...m...Ch<.q..O.+.4i%..j9.bi.9..;.".o.G7/...y'..K..!....W...b...1^[<.9@......:[im1..1..d..'1...1.6..r\|...{<..W..xr.5......_L....C5C`z%.B....0.4o$.j'.a2.,\....<..,lQ...5\|..V..ob.K..<...\|Q....Eb=..`.\,....GzC...e..f .&..]..uBG

C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	2189438
Entropy (8bit):	5.2314927748579185
Encrypted:	false
SSDEEP:	12288:kIEslPzJmNcBEuMAcjuZb51eg5uAJkiRUd:cWdWPuNcjuFMg5uII
MD5:	ACEB459B2F12A03E6D485CDC93280C26
SHA1:	383F01C3FB7FD284F48018622C88E7B1CD8EFB3F
SHA-256:	F22017C35614E73D7200077910844F4F3C4401A665399A853EDD8BD6E550E374
SHA-512:	3D8C3521CA8E899B1B41E04C96843D1E0C88F7FD0792D14FDF038FB9DF6A07C8DF74B6D7189A246D2AA2EAA66F113C533A3B3E7ED2FBB5A3462AB4D63A14D500
Malicious:	false
Preview:	..='..FMmH.a.-[Gd..fF3.......4.{.b.6.D..3...n'...v'.h.....o...p.p.v. .a.p.p.v.1...1. .a.p.p.v.1...2.". .a.p.p.v.:.I.g.n.o.r.a.b.l.e.N.a.m.e.s.p.a.c.e.s.=.".a.p.p.v.1...1. .a.p.p.v.1...2.". ..Wl'..IM}H.a.."[VdA._Fn.......6.q.k.>.k..3H..t'...v+.~...C.9.O.c.o.m./.a.p.p.x./.2.0.1.0./.m.a.n.i.f.e.s.t.". .x.m.l.n.s.:.a.p.p.v.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m._W`'..WMxH.a..z[.d...F9.......3.\|.}.'.(..3...q'...v~.l...U.;.P...1.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.a.p.p.v./.2.0.1.3./.m.a.n.i.f.e.s.t.". .x.m.l.n.s.:.a.p.p.v.1.^W3'...MfH.a..:[.d...F'.......8.x.}.}.g..3...r'...v".y...F.".../.a.p.p.v./.2.0.1.4./.m.a.n.i.f.e.s.t.".>..... . .<.I.d.e.n.t.i.t.y. .N.a.m.e.=.".R.e.s.e.r.v.e.d.". .P.u.b.l.i.s.h.e.r.=.".C.N.MWS'..TMkH.a./[Fd...F........<.v.`.n.(..3P...-'...vp.>.....c.S.0.4.0.4.". .a.p.p.v.:.P.a.c.k.a.g.e.I.d.=.".9.A.C.0.8.E.9.9.-.2.3.0.B.-.4.7.e.8.-.9.7.2.1.-.4.5.7.7.B.7.F.1.2.4.E.A.". .a.p.p.v.JWW'..UM}H.a.$[kdQ..Fv.......f.).6...=.

C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9849
Entropy (8bit):	6.788413407977899
Encrypted:	false
SSDEEP:	192:AGUFflRmn60dB5pyiiDhWzdQgrHB4HcsgaVb0/gd:9Hyx0zdLrHOHcXaVb04d
MD5:	EC645C04E179AF1CDB24984FEDBB1C41
SHA1:	1A96737CB1F00CE7ED129F070573F5A4B1C1F575
SHA-256:	F290861BD4FE6A8A1BC3180AC5BB587D14819B5503B0C24C6D8626D200432CCE
SHA-512:	B19084393F598277C1854B61554239229DA8C285D8CDE1662CB34462DA196E90878831748AD7E232B66148989F5B55F0A9FC13BE201F38FDB2A09CE44E7F4592
Malicious:	false
Preview:	c..3..k..j.Y .d........r!...e.iU...s$.Dg...2..?. 1\..a.......Rath="//appv:ShellCommand//appv:FriendlyName[text()='&Edit']">&Edit</String>.. <String Id="WW_Shell_Verb_New" xpath="//a/..y..o..O.G9.e..A....O[=W.!.,H..F7..Tr.n.K.+[..}..j........U</String>.. <String Id="WW_Shell_Verb_Open" xpath="//appv:ShellCommand//appv:FriendlyName[text()='&Open']">&Open</Strin8.zI..6#.~.D3.B..L.....x#R. .7Y...s...E;.....dz.<.~..j.....R.3JellCommand//appv:FriendlyName[text()='Open as Read-Only'] ">Open as Read-Only</String>.. <String Id="WW_Shell_Verb_Print" xpathb.Xl..z.._.O8.H......Z\|?N....<c..d...E..6...ogGj.g...L....y.B.&Print</String>.. <String Id="WW_Shell_Verb_PrintTo" xpath="//appv:ShellCommand//appv:FriendlyName[text()='Print &To'] }.'1..~P.m.Zo.d..=.....#B4..y.!t..=..........*6?..x...V..Z.\..Vh="//appv:ShellCommand//appv:FriendlyName[text()='S&how'] ">S&how</String>.. <String Id="WW_Shell_Verb_Design" xpath="/p..3..Y..`.i;.f.......kux. .1j..p&..E

C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	687
Entropy (8bit):	7.117900994398814
Encrypted:	false
SSDEEP:	12:+ZNjFd3bS1hI2LeWSmvSRywzqxGTtlk+sIeoLL4O2hpfH+K57r1B1H:SNjFhQmseYQP1plk+v4O2hZLX1DH
MD5:	9D712264236426EEFC6FDEDFB08C92CC
SHA1:	4D3B62FC2EC0761C699CBEAA46902BC964C4ABB0
SHA-256:	FC882BEA51CE1E58C221D1102F03DD495D3A4E0D3160EA5A0ADAB7D7B8507AF0
SHA-512:	CEAC961FA3009EC99BEFA96EB08133D06B272537DFE39B6E1DCEDDDFE9E16D7336B66ABAED78A187374BE0D8F0AB38115169A101BB6E6049BE778DA215F4FBD6
Malicious:	false
Preview:	..e?.d..g..`7..S.eG>........G.2....?.3.D^...:..[.0.q....:...I3}io.;..L..`.X.b.GfK.....:.EF~....%.}.BQ..N6......l....p...^n&8<.q....%y.Z..f.0M5......\F~....l.~.BE..S4.....".s....y.....Ey~.4...d)...9w./........T.2..."'.J.KC...VD.......u..?.v...ZN 6.I..N..k-.U.b.GfWPX....AU....p.yA<..S(...Y.y.s....x...Variables>.. </appv:Extension>..</appv:Extensions>.....=.._L{....#.G.........>.L..L..x..l......(.4B....0.A....E\|va\,y....-.B_j.+.G.I6..z.\6..F9x+A_.(.....w.x...Z..SW.dCE.......X.t.T..P.u...E \|.n.A...........k.^..D.*....V..T.....X...~...J.F...v<.5...fH.../...................................................................................@.........vux2f891j9j.

C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate.exe

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	221978
Entropy (8bit):	6.764182921543639
Encrypted:	false
SSDEEP:	3072:skEfPnR/1fyTueYdHwz4L5hgr7cbXQvVdScLscPah77S2HLTn3:TQdfyTueOQz4L5hecmCcLscm7PLb3
MD5:	B9DB239C9E5BD77807C318760387DBF4
SHA1:	B6F926331736B0740EA995D811265D2B04CCDC77
SHA-256:	949A14163F96D0365B1DE30EEF0D3F383BF52FE1A0847B0C2E0AF32E1B83ABC8
SHA-512:	78C633B1AC9B48ED98459FA334D193CB2735630C9A4E0B26E5C94E8A3CD975B63CDC1DA0466BF93FEB86549079FCA6CEDE39B13B6AB2A4B1DE90B44231792231
Malicious:	false
Preview:	m$.)....T.~.j...?....%.%.oz.0..`;.:.n.8...y#9.c..5.7.....f..............!..L.!This program cannot be run in DOS mode....$....... .(.d.F.d.F.d.F.m..l.F...B.h.F...E.`.F...C.{.F...G.c.F.d.G...F....^..b...J..60fX.b....>.U...i.Y..,~;..y#9.c..5.7....#..5................"..........P.................@.............................P......x.....`.......... .............................. ~.)....pS\|.5^....../!.%X.y....`;.9..8...z#Y.c....7.....f.............e..(...`d..8............e...............................text............................... ..`.rdata.................. ~.)....P.~..^.....ef%.%.{z.0..`;.:.n&:...y#9.c..5.7......................................@..@.rsrc...(.... ......................@..@.reloc..`....0... ... ..............@..B................ ~.)....P.~.^.......%.%Xoz.0..`;.:.n.8...y#9.c..5.7.....f.................................................................................................................................... ~.)....P.~.^.......%.%Xoz.0..`;.:.n.8.

C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	167690
Entropy (8bit):	7.097198038381506
Encrypted:	false
SSDEEP:	3072:6ZSvveNluaSr8WA+WXGz1RYAJhiU/vc5DQ1eqr:6ZCvguac8WA+WWRRYAJhixc/r
MD5:	AD3CF4A395A18D6D084C969804620155
SHA1:	184EC9562C773FBA174A154ED6BC4E00C30E0195
SHA-256:	637776F8D141E013C267F2F11B5538F16C1B7644B2810739CE6D784C78DC2437
SHA-512:	6F77E6A4A5B4ECE154112222C4D82F4C4C0DAD8914274B49EFE05B5710B01967502331F03849939429FD6B3ED09B15EDD1D6D676B0A73F357B0B01B18C46ED02
Malicious:	false
Preview:	...&.;.%.....L.......<...1A4.u..\|..(..W.......<.,[.I\..a..........!..L.!This program cannot be run in DOS mode....$.......,3.zhR.)hR.)hR.)a.)`R.). .(nR.). .(wR.). .(oR.)hR.).V.). .(AR.)....piq.1.);...e........}...wc...C....4.(..W.......<.,[..\.M`..#.@..................&...H......`........@....@.......................................@...... ...........................Q......@.e&2?.%...\|-.L`...<....L...A4.tt..\|..(..W.......<.,[q.\..a......@............P...............................text....$.......&.................. ..`.data........@.....................@...n..GnZ.%...\|}.L`.....<...1A4.u..\|....w%.......<..[.O\..!..............@..@.reloc...%...p...&...F..............@..B........................................................................@.g&.;.%...\|-.L`......<...1A4.u..\|..(..W.......<.,[.I\..a..................................................................................................................................@.g&.;.%...\|-.L`......<...1A4.*u..\|..

C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	221978
Entropy (8bit):	6.754653045185019
Encrypted:	false
SSDEEP:	3072:CgzQD5L1sbPTxWqTOBROX7+XUgDkLzVhVixUM3tTFwgmz1g+pPM:CrD5JQWqC+XCkgDCVhVixUM3tpJSg+tM
MD5:	28069BBC77833096E3C2A7FC8DA74171
SHA1:	012D0E9580852D49A50D8AE351F8CCD0592ACC31
SHA-256:	482400F5E330F9E8B85911A89ABD74FD7F9FCB6DDDD23C2C1220D46FCF6AD327
SHA-512:	DB1EE5300FFC5715869A3EB5A3DE2B2835451FDEA4398553D855CD33229D073870B347D23B633DC3EE024EE320AF01FE8709F1229367BC29C5658113074814F1
Malicious:	false
Preview:	.e...k<SRn.,.....g.%...\|..:w..$p.....Y...,....n...?.J`.#Iz...........!..L.!This program cannot be run in DOS mode....$....... .(.d.F.d.F.d.F.m..l.F...B.h.F...E.`.F...C.{.F...G.c.F.d.G...F...!xB.z...9.*..l.k.1@?.{.._.Z_v.t..8K...,....n...?.J0.#I.................."..........P.................@.............................P......x.....`.......... ...............................?o..k<Sv..,.q..%.d.....Dl...y..$0.....Y...,y.......k.J`.#I.............e..(...`d..8............e...............................text............................... ..`.rdata...................?o..k<SVn.,.q......D...h..:...$`...2.Y...,....n......N.G(...............................@..@.rsrc...(.... ......................@..@.reloc..`....0... ... ..............@..B.................?o..k<SVn.,Lq..%.g.%..D\|..:w..$p.....Y...,....n...?.J`.#I.....................................................................................................................................?o..k<SVn.,Lq..%.g.%..D\|..:w..$p.....Y

C:\Program Files\Microsoft Office\root\Client\AppVLP.exe

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	500786
Entropy (8bit):	6.9883852549958485
Encrypted:	false
SSDEEP:	6144:igUiwU8A6/YW9oXNrRvQZNGiIHkZDWA9yXtESOvuoQFOGmyVubTLrw+x4v8:igU7/mlvuMMl96iGoQ9UfP4E
MD5:	5F11B79A7D0C71CAD126670BB318F6B6
SHA1:	58AC0EF53A5F7BCCAFEB1E777E61382B27F40610
SHA-256:	1FC7921E54DFF7FC9C2C1222978B6EC6E762F8444EEF89534F869B5D531B4F02
SHA-512:	0E53E6AE52172F18965DF06FEE134D8568BCC08D65BFD08EBAAB6936527BA2DE890704DF97A0AE0DC39CBEE855F74AB7D6AA6836F87D959BAE4022BE457B300F
Malicious:	false
Preview:	.^Rh.M..r.u.#...8G.nR.Pg.).G+.B.}...dIo.'.Y...X.<.2j1...N...........!..L.!This program cannot be run in DOS mode....$...................`....^..._.R..2.q....2.t.......*.....C..Y....2.y.o.&..X.>......^/.\|...p'.Y.....<.m1`B`..........".................X-.........@.....................................j....`....................................................h0M..v.r.@....n..PgOw.G.B.}a...ko.g..Y....X.<.2j1..................p............................................text...p........................... ..`.rdata..j..........................h.M..X....F..P..nR]VgO..G+(D.}...dIo.'.Y....(.].Sj1_......:..................@..@.c2r.................0...................rsrc...p............2..............@..@.reloc...".......$...:.....h.M..v.u.F..G.nR.PgO).G+.B.}...dIo.'.Y...X.<.2j1.........................................................................................................................................h.M..v.u..F..G.nR.PgO).G+.B.}...dIo.

C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	"compact bitmap" format (Poskanzer)
Category:	dropped
Size (bytes):	18938
Entropy (8bit):	7.430776920900722
Encrypted:	false
SSDEEP:	384:8H7QhW29kXwkqfkaVi6jsqVaD5FLTz/g09bYu:8H7QnkACacLI+Tzo0N
MD5:	0E57C0BD8EFC574A76DD46E005140B64
SHA1:	8E95D4D155E23D1D0324CCFCAE8C8EBCF6475CCC
SHA-256:	1BE2C230404C1E87149BEFA418CFA7D495C84E1F9753BF128E215C5DE44D38CE
SHA-512:	A5BCFE76359B8C3E25EACC6B2787372EE586AEA1994CA8563923BA809F202007B3F26BF527F243DA4F7B7EEAE8CABB56BC1150B1420B413E475772EFC7128723
Malicious:	false
Preview:	.*1\..q..j..9..Ud..tf.In..T;,.bX2:...(..?..iCB.R..]..n7..%.o........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........Zp.\..q..j.zk.9..Ud.vf.q...T;,.bX2....#..?..iCJ.R..]..n7.?5.o.................................0............`.........................................`...L............ ...................<..Zp.\..q..j.Bk.9S.Ud..tf.In..T;,.bX2:...(..?..iCB.R..]..n7.?%.o.........................rdata..\...........................@..@.rsrc........ ......................@..@........................Zp.\..q..j.zk.9S.Ud..tf.In..T;,.bX2:...(..?..iCB.R..]..n7.?%.o................................................................................................................................Zp.\..q..j.zk.9S.Ud..tf.In..T;,.bX2:...(..?..iCB.R..]..n7.?%.o................................................................................................................................Zp.\..q..j.zk.9S.Ud..tf.In..T;,.bX2:...

C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	18938
Entropy (8bit):	7.491476428213823
Encrypted:	false
SSDEEP:	384:IH2PhWbnvv5KSfdPVVvjn0ySWox7lDZJ+pXbu:IH2PuX5KEB0XWofDZUpC
MD5:	12302851FE39854AD99DABF2B74847B5
SHA1:	E6ECA7D0441C364613A4B47A814DF8AF729DE42F
SHA-256:	2452C51C15B374FC2FE0A26EC628BDA606077C12536EDCC86E2106C0526DC748
SHA-512:	E23F5983EF1BD6B28B352085B9B837332C4D0CEDAAE2EBCA679E3D3A1735C80C4FFCC71C2A29A671F899434E39361C50AFC44AA8C6DEAA4E97C93CD8D8F4854C
Malicious:	false
Preview:	D..9.H,e.....e..N..C!..&Yv;.aa...h....6.u..5..}.{y....a..../...v........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S.............9.H,e....l......CE..&.N..aa...h..@...~..?..}.{q....a....//..v.................................0......{r....`.........................................`................ ...................<.....9.H,e....T......C!..&.v;.aa...h....6.u..5..}.{y....a....//..v.........................rdata..............................@..@.rsrc........ ......................@..@...........................9.H,e....l......C!..&.v;.aa...h....6.u..5..}.{y....a....//..v...................................................................................................................................9.H,e....l......C!..&.v;.aa...h....6.u..5..}.{y....a....//..v...................................................................................................................................9.H,e....l......C!..&.v;.aa...h....6.

C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	21498
Entropy (8bit):	7.502921080289512
Encrypted:	false
SSDEEP:	384:Bx2WWz9qwOdp3kwF00NRrnd1hUW7iGSAuSLaVZd37Suc86nb8adEs6QGtU:Y9qwOdpUwF00NRrndxiOmc7Ldb62
MD5:	96DD5650361C0A64AA09B835DD5AD901
SHA1:	5005328D6088A04B76E4F35041F2F630E4C83A1F
SHA-256:	58F11B46858AC8DAE86E6FE4327A38C8D40D310FD4B5FB8043C93AAA911EEFDC
SHA-512:	4D34412D918722060ABADFE5EF7BB8BDD447B320523D5818479345F6E2511287B8124AA78EB643FF608685E10F2AB3B0A8F04545D2EF196616869D48FB956151
Malicious:	false
Preview:	h....G.e.V?.I.^..)9.....-.C.Kdx.5&.n...rg..KQ.;[..).......m........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........%....G.e.V?.u..^..)9w.....C.Kdx.5&.n...pk..KQ.)[..).......m.................................0......w.....`.........................................`................ ...................<..%....G.e.F?.M..^..)9.....-.C.Kdx.5&.n...rg..KQ.;[..).......m.........................rdata..............................@..@.rsrc........ ......................@..@........................%....G.e.V?.u..^..)9.....-.C.Kdx.5&.n...rg..KQ.;[..).......m................................................................................................................................%....G.e.V?.u..^..)9.....-.C.Kdx.5&.n...rg..KQ.;[..).......m................................................................................................................................%....G.e.V?.u..^..)9.....-.C.Kdx.5&.n..

C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	19450
Entropy (8bit):	7.466230575690277
Encrypted:	false
SSDEEP:	384:gnYlFeWWbWT7wpx/v9LyliNFOMNRVAVYu0pwLbaj:g4FeuG3+C1VAVqwqj
MD5:	AA59DDE20FC92279AED2D8A894A5D227
SHA1:	B707411A04771B17E13429405D04F44342F6F56D
SHA-256:	08B3D9CD3A6362EAD05B81A4870CE601C95D7C131AB29FF79BE3DD25208C7A26
SHA-512:	C080B932A7D8ABCFEEEA358865D46DB9297EEA74C0F8F1BD01ACED98D0CF8D8EADC0A51FCB42CCE4B30C87B8CD48ECFE1B11542859BFDC2860338B0A31EE43B6
Malicious:	false
Preview:	....:...5.2.5Z..V'...A.Z.....H#.0D.K.=....-.'..d.?:..?.o"...<..........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S.............9...1.2.....b.....Z.....H#.0D........'.'..d.?:..?.o"...,...................................0.......[....`.........................................`................ ...................<.....9...1.2....'...A.Z.....H#.0D.K.=....-.'..d.?:..?.o"...<...........................rdata..............................@..@.rsrc........ ......................@..@...........................9...1.2.....'...A.Z.....H#.0D.K.=....-.'..d.?:..?.o"...<.....................................................................................................................................9...1.2.....'...A.Z.....H#.0D.K.=....-.'..d.?:..?.o"...<.....................................................................................................................................9...1.2.....'...A.Z.....H#.0D.K.=.

C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	19450
Entropy (8bit):	7.488391698263254
Encrypted:	false
SSDEEP:	384:QH7NhW2W7wfhycarIJTptNKGRDdOXhPhGorMcZl3M7+Q:12GrO+GSxX7TQ
MD5:	8F7600AECF8C4D5A55CA23DE20FD7BDF
SHA1:	1A8F340D0C22094E93B5959EC0BD4F0862F5449C
SHA-256:	4FD7479C41BBBAC0D0A8EE660AA25E15039864A9D13AF2733315AFEDB1F0D4A6
SHA-512:	4711D715967D39F0952713F28BA852C5B2A0AAB22050DAE526D1CB4DA028DBCB4B854551331E29AE5793E9E2365BE0E55FBD16F9170AD34B3D91480E7043DE0E
Malicious:	false
Preview:	..t....^a.....s....z.......v.....3.....SX..(.....?.k....\|/)...........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S...............^e...T.s.X.......m.v.....3.X..&XZ..(.....?.k....\|/)&...................................0.......!....`.........................................`...v............ ...................<.......^e...l.s.....z...Y...v.....3.....SX..(.....?.k....\|/)&...........................rdata..............................@..@.rsrc........ ......................@..@.............................^e...T.s.....z...Y...v.....3.....SX..(.....?.k....\|/)&.......................................................................................................................................^e...T.s.....z...Y...v.....3.....SX..(.....?.k....\|/)&.......................................................................................................................................^e...T.s.....z...Y...v.....3.....

C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	18938
Entropy (8bit):	7.508465957459662
Encrypted:	false
SSDEEP:	384:BOhWrN7f9f1ZFj9BPZ1H3NpXYfDxz/qTGEEe:cmNhNedOD5
MD5:	14D2ABE57CAE2C715CE4E398348B14DA
SHA1:	F3F262F3597C637FEFE1A8AEA799D19CDE516E42
SHA-256:	5C40C55BAAF0D2469591DA5E88F6720C7DEC1386779A3AD3D5DF2E309AAF5FD9
SHA-512:	03D65CEA4B1E6EB4221419B42773BF9D7E7C90A3C7BD235083734B07146F5108F2166DBA07906B9184BA47F5ECC7ED9BA9B2D913D69FB05D31731AADF4407093
Malicious:	false
Preview:	yY....&.=v....lh..k.x...,.5..;.5fu..R..,.Z._.%...g.B..-5.=........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........4.....&.=v....-.b..x.Py.5..;.5.u..Y..&.Z._.-...g.B...%.=.................................0............`.........................................`................ ...................<..4.....&.=v.....h..k.x..,.5..;.5fu..R..,.Z._.%...g.B...5.=.........................rdata..............................@..@.rsrc........ ......................@..@........................4.....&.=v.....h..k.x..,.5..;.5fu..R..,.Z._.%...g.B...5.=................................................................................................................................4.....&.=v.....h..k.x..,.5..;.5fu..R..,.Z._.%...g.B...5.=................................................................................................................................4.....&.=v.....h..k.x..,.5..;.5fu..

C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11930
Entropy (8bit):	7.264074601246327
Encrypted:	false
SSDEEP:	192:E/hb2xhWq1aWwLBEMHIFmb8zUnUcXAqZMSffByD/BG6EF2r0jY:EZb2xhW1LBE08gnUchZffc1G6rwE
MD5:	EF130ECDE0978BFCF69FDB117C4BCB0F
SHA1:	A16424C49B47192A6E061E568B4CEDC192E0B55D
SHA-256:	BE0A3758E84791510529E9B2362CD0902468785023373D4321EF0F578D297D95
SHA-512:	B88FF15775749D8D43CDC15750C81E2B58536DDF09127687BAC48CC2EE411F56713502F4C443B2C346746701A8DF63DA3FC56005C87EB36EEA47A2475A0B1A32
Malicious:	false
Preview:	Rg..r.}..VB..aL.1.{%Z..[.97.-...Y..ty6.=..V.....w.I..k..d..j........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S...........=..q.}..VB.o.L..]{%>Q.....b.-...Y..t[..?..V.....w.I..k...>.j.................................0............`.........................................`................ ..................`!...=..q.}..FB.W.L...{%Z....97.-...Y..ty6.=..V.....w.I..k.....j.........................rdata..............................@..@.rsrc........ ......................@..@.........................=..q.}..VB.o.L...{%Z....97.-...Y..ty6.=..V.....w.I..k.....j.................................................................................................................................=..q.}..VB.o.L...{%Z....97.-...Y..ty6.=..V..*...w.I..k.....j.................................................................................................................................=..q.}..VB.o.L...{%Z....97.-...Y..ty6

C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	19962
Entropy (8bit):	7.5005868966585725
Encrypted:	false
SSDEEP:	384:9MrWWaQYZGP+EKfk5SW/F8KeAcyUipeJYEnqPBrIT25:/TwYe/j6fvYeqsi
MD5:	D3E3F527CC7269FF06112AB3AC0D6831
SHA1:	EB065BA343377C24667D0CA49226A2D69F5B1516
SHA-256:	066ADCE9D1AEEBCBEE0CE732D43887C0DA1DFA7380C07A675746DA9BCBF10A21
SHA-512:	6C7D877391EE2F2F39B27F6FE9E59F089ABD8E7D78F8BF3D3742E0ECFC754B9A0DCF7800F619A62110DCDB3F4ABF1F30A93A033954D5F9B8F16575B8396973F3
Malicious:	false
Preview:	..Suf.{n6vO?..W.....]...4'E.R...J.Z....e...v{.b..[.q2..............!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S.............ue.{n2vO?..W.....9...@..R...J.Z./..E...v{.b..[.q2......................................0............`.........................................`................ ...................<.....ue.{n2fO?..W.....]...t'E.R...J.Z....e...v{.b..[.q2..............................rdata..............................@..@.rsrc........ ......................@..@...........................ue.{n2vO?..W.....]...t'E.R...J.Z....e...v{.b..[.q2........................................................................................................................................ue.{n2vO?..W.....]...t'E.R...J.Z....e...v{.b..[.q2........................................................................................................................................ue.{n2vO?..W.....]...t'E.R...J.Z....e

C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	23034
Entropy (8bit):	7.414850515029525
Encrypted:	false
SSDEEP:	384:FE9Af76K3FyqW2XuYs57x7gLhlt/hbWmIJRyRDev53iwhzmq3Z0zY:FHXuN5NgTxxWd7ydevdiymqJYY
MD5:	89034EDD47A08043092EBD304252A39C
SHA1:	EB58C4E718EAB7DCED8C13816B87BE7160FD637F
SHA-256:	092C65359491B5511186F94A9F68233BF307720451F60580B49C285C286EE8EC
SHA-512:	93040CE3B607F8C81478CAB4EE390CEE0509FC600B8627664EC5DDD89001EDF7215AD484B07B4B6D23E078915B63E47CF034CEFEB35090F608DAC78083C438B9
Malicious:	false
Preview:	OI>.......~.t......t....\{....]..Y.r .U.:...P....+..mJ.Xdp.........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S....................~..f....t.-...d....]....P..W.0...P....+..mJ.tp..................................@............`.........................................`................0...................<............~..f.....t.....\{....]..Y.r .U.:...P....+..mJ.dp..........................rdata..............................@..@.rsrc........0......................@..@..................................~..f.....t.....\{....]..Y.r .U.:...P....+..mJ.dp...........................................................................................................................................~..f.....t.....\{....]..Y.r .U.:...P....+..mJ.dp...........................................................................................................................................~..f.....t.....\{....]..Y.r

C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	19450
Entropy (8bit):	7.464414182575988
Encrypted:	false
SSDEEP:	384:+xTAAGAApWEoWMSnQfnTNJi8PWYOL0ARlvxNk5RHTu:i6y2QCPw3Hq
MD5:	EDF758711F821BD687D7AF46D0676151
SHA1:	E428B36F5218A3BDFED469715598865FB987DADF
SHA-256:	2F09B4FA50870B82C4D975472D9CBB5A9ECDCE547E08736D2D08910B0A28208A
SHA-512:	EAB05892486F226A60A8F3C034EDC680717FF84812B6C2C033C9ABEF4E8733748429EFB86A4CB1F2C7C6BB2BEF1BB971E4B5F0390935961D3C6C4BBB96F9BE2B
Malicious:	false
Preview:	IT3.h.....a.TW...F..E..P...Q.i...+..W..].b.%..7.....7...Z.S.........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..............h.......TWB..."i.E.....Q.i......w..Q.b.%..7.....7.....S..................................0............`.........................................`..."............ ...................<......h.......TW...F..E..P...Q.i...+..W..].b.%..7.....7.....S..........................rdata..<...........................@..@.rsrc........ ......................@..@............................h.......TW...F..E..P...Q.i...+..W..].b.%..7.....7.....S.....................................................................................................................................h.......TW...F..E..P...Q.i...+..W..].b.%..7.....7.....S.....................................................................................................................................h.......TW...F..E..P...Q.i...+..W

C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20986
Entropy (8bit):	7.449498564685134
Encrypted:	false
SSDEEP:	384:Hy79DTweOWYWLJs4G18CnWPKwXyKepkyL2itxGJ+k0Wz04Zi6o:Ho9DceFeJ9nINyZxtM01L
MD5:	0DCD944EC781E8431B15392481A83F30
SHA1:	C29264475FC37E80F1BA0952D13F203441DD334A
SHA-256:	5CBA0A3C437AE2584873E5A47001ADACA47660A7608B8FEA37D6481FA3F05F37
SHA-512:	FE63E2A672515CCFBB3915E3AC7CB90C73584D772FC5A1047DCB5482EEF4EE0E83CD173109E7614AE3E957C23572C40413D8007963DB37D02366A9FC244531B9
Malicious:	false
Preview:	*QUS..V&...@..%.H.k X....F.V.C.....Fd.@-...F .h..;..U..C..Q.a.........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........g..S..V&...@%.%...k <......V.C.....d.`&...F .h..;..U..C..Q..a..................................0......XV....`.........................................`................ ...................<..g..S..V&...@..%..k X....F.V.C.....Fd.@-...F .h..;..U..C..Q..a..........................rdata..............................@..@.rsrc........ ......................@..@........................g..S..V&...@%.%..k X....F.V.C.....Fd.@-...F .h..;..U..C..Q..a.................................................................................................................................g..S..V&...@%.%..k X....F.V.C.....Fd.@-...F .h..;..U..C..Q..a.................................................................................................................................g..S..V&...@%.%..k X....F.V.C.....Fd.@

C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	19962
Entropy (8bit):	7.46869843140357
Encrypted:	false
SSDEEP:	384:eNhAAHMl8AAVWi9nhaWPMtf1s4RLhG/1Lo2ASNIR5U8XC0t6GzfA:T098LB1h+xAV/EGzo
MD5:	22939587C9B1B2DD037BE2B23480D20A
SHA1:	5F7F937C72C3018CF6853FEB4465321FD2C7300A
SHA-256:	02C6DE32C20BC6053942ED26399EAF83D5D9F4F3057740A475260F6917C4D875
SHA-512:	8EDE813AE091B4D70CC32B6E1086E1B7C8BED0BE7C6862B3C13486BEAC7C589E4020934A870045C9117595A7C27AC411EB989EB4428B40121A4D90B85C6177E4
Malicious:	false
Preview:	.J0.MM..k.%.Q..c."..5..mJ;j...[v.)M'......W.?Lw..z.........ZVh........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..............NM..o.%..q.."......r.?...[v.)M.......].?Lw..z.........JVh.................................0.......L....`.........................................`................ ...................<......NM..o.%..q.."..5..-J;j...[v.)M'......W.?Lw..z.........ZVh.........................rdata..(...........................@..@.rsrc........ ......................@..@............................NM..o.%..q.."..5..-J;j...[v.)M'......W.?Lw..z.........ZVh....................................................................................................................................NM..o.%..q.."..5..-J;j...[v.)M'......W.?Lw..z.........ZVh....................................................................................................................................NM..o.%..q.."..5..-J;j...[v.)M'...

C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	19450
Entropy (8bit):	7.489758472821505
Encrypted:	false
SSDEEP:	384:k9rw5WqcWC5DM8aXmcJn1mcvLJOyuQfX5ZyPNE4:C73c2FyumiFt
MD5:	AB3E0642526E51C67FA84D16787CD421
SHA1:	144992CA257903990A207337394DF9E5C89744F4
SHA-256:	271248C609EE72068AAE02107AC1F47C94ACE6740D882CDC1E83A9FB10DD0608
SHA-512:	FB4400F07EB1E3FBEC0FDEFCBF0FA4DD3646391BD8BC15F6E1C10DAC678AAA62DE97D1A6DD2910E3B4417F071D46CBBDE7DCB3FC2EF92A3BDB068F86B8AE7C4B
Malicious:	false
Preview:	.}.$1......j.$-u.b.....C....H..=}W....?6....(.X....RR..UR............!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S...........'h$2......j6.-u.'.....C..{BH..=}W.4.,44....(.X....RR..UR'....................................0......gP....`.........................................`...e............ ...................<...'h$2......j..-uQb.....C....H..=}W....?6....(.X....RR..UR'............................rdata..\|...........................@..@.rsrc........ ......................@..@.........................'h$2......j6.-uQb.....C....H..=}W....?6....(.X....RR..UR'....................................................................................................................................'h$2......j6.-uQb.....C....H..=}W....?6....(.X....RR..UR'....................................................................................................................................'h$2......j6.-uQb.....C....H..=}W....

C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28154
Entropy (8bit):	7.25577521167865
Encrypted:	false
SSDEEP:	384:23k40+CM49xzAKRhpm6DVRhWa5pSKdTfSMH9ENGjqG+32ab694Id4YMVWQ4vFB:Yk40+CMUAKRrhRhDTdAaM6vZdF
MD5:	C6CC6DFA4B320AA8CF006BD5F49C2259
SHA1:	3AF41EEA192E2F004F97C31792B95E8814C35C4E
SHA-256:	03DE93CD78DAC0DFAD6A1C01CA468B3E67FD076D2F9D2DC7A85E7409D5591EC2
SHA-512:	38FF5BF80F5C4C4429626F3B15EE7F401412CCCFB5FBB2DC91DC8FA2CE8A684F68C62759E43684B570E36568744391E7DC33F3DACFCCBC45DD2E084BAFD184BD
Malicious:	false
Preview:	...{...x6.P.!.%t^.kMs1...r.3AG..z.......T....$...V6.N%..tj............!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S...........A9{...x2.P.T...1^...q1~..'.3AG..z.......X....$...V6.N%..tj5....................................P......).....`.........................................`....%...........@...............0...<...A9{...x2.P.l..t^.kMs1J..r.3AG..z.......T....$...V6.N%..tj5............................rdata...&.......(..................@..@.rsrc........@.......,..............@..@.........................A9{...x2.P.T..t^.kMs1J..r.3AG..z.......T....$...V6.N%..tj5....................................................................................................................................A9{...x2.P.T..t^.kMs1J..r.3AG..z.......T....$...V6.N%..tj5....................................................................................................................................A9{...x2.P.T..t^.kMs1J..r.3AG..z.....

C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-multibyte-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	27130
Entropy (8bit):	7.2939912376443745
Encrypted:	false
SSDEEP:	384:5ELfImIHJI6XCeF2G3t3rlWZW2/L33H3ZQOQ0D6QFRid59M21519bPw1:+MmIHJI6TMTX+b0+UXb1
MD5:	544B89F87E652B79FD86E51F880478F6
SHA1:	042CDB9B01F25F50B62D8A8C4B96CBB22B0178CE
SHA-256:	2A429945A3212039887F6623E16A6DFC4EC13D505C86E6250F92678BE80CF14F
SHA-512:	477A9548D6620A57D627740F37D69D1240E4AB32F6EAC15CA9B29A4D34B28EBBFA4BA626D7DA5D78AC4E4AE908C157027DD25F12930712D4481ED88AAF649A61
Malicious:	false
Preview:	^3o.5q.......v..V.R.G.E. `+Y}N.X]...9.)..>.Z#s.6...5....H............!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S...........i..6q............R.#\|G.TX..}N.X]........2.Z#s.6..5....H.d...................................P.......!....`.........................................`.... ...........@...............,...<...i..6q..........R.G.E.``+Y}N.X]...9.)..>.Z#s.6...5....H.d...........................rdata...".......$..................@..@.rsrc........@.......(..............@..@.........................i..6q...........R.G.E.``+Y}N.X]...9.)..>.Z#s.6...5....H.d...................................................................................................................................i..6q...........R.G.E.``+Y}N.X]...9.)..>.Z#s.6...5....H.d...................................................................................................................................i..6q...........R.G.E.``+Y}N.X]...9.).

C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-private-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	71162
Entropy (8bit):	6.840993267812088
Encrypted:	false
SSDEEP:	1536:+B4bFR2XNCVcvx3DWpD0u33jwkZne/D0I3CsBnWTq0od+H:+B4bFR2ucvx3DWpD1338kZn073jU20oq
MD5:	56A3B45E6098E543BCEED34AA401FBCB
SHA1:	A74A41C245D722BFE31B94191B1B581F0F8C1567
SHA-256:	DB81701DECC555698C6F003F15E72BABCFD2E7215B41DF83C348EABC89551D3A
SHA-512:	BF5852D9EFB2504C22AB9C3E3BE2CDCBE145F1F696E5C0320A1B889B945094BC1739C22FDC2BE6F32A33F3B8DEC7B402B39B7B9E79C20CEB7EED4BB67103DC86
Malicious:	false
Preview:	z.(.&1Z.o.....x..8...a....WD.r3..[I..u..~+o+.B..fG...aB.b..y...........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........7...%1Z.k...aXx.8}.......D.r3..[ID.W..\|'e+.B...G...aB.b....................................................`.........................................`....................................<..7...%1Z.k...YXx.h8...a...WD.r3..[I..u..~+o+.B..fG...aB.b...............................rdata..............................@..@.rsrc...............................@..@........................7...%1Z.k...aXx.h8...a...WD.r3..[I..u..~+o+.B..fG...aB.b......................................................................................................................................7...%1Z.k...aXx.h8...a...WD.r3..[I..u..~+o+.B..fG...aB.b......................................................................................................................................7...%1Z.k...aXx.h8...a...WD.r3..[I..u.

C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	19962
Entropy (8bit):	7.459840088272803
Encrypted:	false
SSDEEP:	384:oJJqR72WsFKIFUf8Sbh4ak2L16KR5MEUCs3eE++mER:oyR7GdUfR13lE+pi
MD5:	A4CF60B02FAD03E1EC4865E39BBBB1FD
SHA1:	89A33BF4FA23A22C4241FEBF861E70C34AAEBF8F
SHA-256:	76FC726C119E6E6C83D6EC58646A6119852DB714EED43907BCB9E525041C22A0
SHA-512:	29329F0A14A75AE024C554F0A5FD497E8C77BF73C8FEA57845F5EACB6C25B314FC2AB7870D769353465B34CEFA290DFCE80127D38682EA8489C89AFFBF67ED5E
Malicious:	false
Preview:	.5..@9.h....uRP...k..U.\|.5.....Q(.C\_t .A3R..i.'2..<...............!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..............@9.l.....RPk..k..W........Q(..~..".K3R..i.'2..<.......................................0............`.........................................`...x............ ...................<......@9.l...?.RP;..k..U.<.5.....Q(.C\_t .A3R..i.'2..<...............................rdata..............................@..@.rsrc........ ......................@..@............................@9.l.....RP;..k..U.<.5.....Q(.C\_t .A3R..i.'2..<..........................................................................................................................................@9.l.....RP;..k..U.<.5.....Q(.C\_t .A3R..i.'2..<..........................................................................................................................................@9.l.....RP;..k..U.<.5.....Q(.C\_

C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	23546
Entropy (8bit):	7.383826810712348
Encrypted:	false
SSDEEP:	384:Nv3cSrM+CGF/02whW10/39ifB2Wjgj4VTeMzvZ9pftRu:53cSrM+CGlDwL/9LGTeqpbu
MD5:	104C578F9253BCD99E24219CCA3BF2E1
SHA1:	48284DBD38AD49A72B8021DEFE962A83F1107479
SHA-256:	F7F51B4B0C61058BDC979ECBA7B0CBE4D62E874820BA4DA90F494713AADA0594
SHA-512:	BCC6B822A9DD98957B771F87F395443D2FAF997FF03A7DF7D4B657201FAC96CB494694337B1D8A8D657C1BD29968E7935AD2BC51B9F3163E56494783B4EBDB9C
Malicious:	false
Preview:	....~%A\.....,.Dw..8X..A....%'._tz.t.''...gi..^..F.3..q.W..A.........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S..........K.X.}%A\....n.D.:.8<..A...%'._tz.t['.....mi..^..F.3..q.WM.A..................................@.......8....`.........................................`...4............0...................<..K.X.}%A\....V.D...8X..A..%'._tz.t.''...gi..^..F.3..q.WM.A..........................rdata..H...........................@..@.rsrc........0......................@..@........................K.X.}%A\....n.D...8X..A..%'._tz.t.''...gi..^..F.3..q.WM.A.................................................................................................................................K.X.}%A\....n.D...8X..A..%'._tz.t.''...gi..^..F.3..q.WM.A.................................................................................................................................K.X.}%A\....n.D...8X..A..%'._tz.t.''.

C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25082
Entropy (8bit):	7.3468344487779
Encrypted:	false
SSDEEP:	384:7GtnawYeVXouodTcak1ChWrSsazNfoUnj//OW2ctx26QSV:atnawnVXPouakYc6fOW9e6QSV
MD5:	A0BCD08F1A90636DD8636161A1AC26FC
SHA1:	59ACF9042877CAB965856F6A366513A182C1DB5E
SHA-256:	EBD87EE6AE2BEC940281EFFB95DA1A25A7E3B99D4F06C27521338B3F481402E4
SHA-512:	B9C8F30E749D1C09745F7CE3DE6A25A0FD9D80A7F2E2366C0D112B1C0B37C2FCA2B4087A85C5DCC437C434647B80A35F41AD90E56A5EB2CB070E686415CAC16C
Malicious:	false
Preview:	..V..C]....iUf.'...c...=.~.8...k.._0m._F..`..R".:..P..uB........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S.............C]....k.Uf2b....a..U~.8......;o.UF..`..R".:..P.uB.................................@.......>....`.........................................`...a............0...............$...<.....C]....S.Ufb'...c.=.~.8...k.._0m._F..`..R".:..P.uB.........................rdata..t...........................@..@.rsrc........0....... ..............@..@...........................C]....k.Ufb'...c.=.~.8...k.._0m._F..`..R".:..P.uB...................................................................................................................................C]....k.Ufb'...c.=.~.8...k.._0m._F..`..R".:..P.uB...................................................................................................................................C]....k.Ufb'...c.=.~.8...k.._

C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25082
Entropy (8bit):	7.365860297327942
Encrypted:	false
SSDEEP:	384:y54jgW7GI2CQgxPgA7y6tlyhWFuF6OkbfHxr7jINB6f2GRL6NQJ5IIZZNR:tjRx2CQgxPgA7VudRkVoKxpfPZZNR
MD5:	B65D8CA54B720B8531BE3AFCA7A34B35
SHA1:	E563FEA92D82B9D9CD0EAFB209C594E75CF5F910
SHA-256:	6E38E25D0F28DF5C1713461D075E0B589DAD9FE17DBF0729C0982E1579929599
SHA-512:	8750F771719BE51EEF2B63B08ADBD6D94596D132F9FE6BB7EA9D1EA5BB8016A01526BE14AECE892FDDB42A0B3E78203F92F7C31F15109A221B1450183E623AA9
Malicious:	false
Preview:	....`b...Q:.QL.W\..e.<O.7..Y.{......V. ...)....3.\|.<........(........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S...........L.cb...Q:....W...ej.M.C.N..{............%......\|.<........(.................................@.......3....`.........................................`................0...............$...<...L.cb...A:....W...e.<O.w..Y.{......V. ...)....3.\|.<........(.........................rdata..............................@..@.rsrc........0....... ..............@..@.........................L.cb...Q:....W...e.<O.w..Y.{......V. ...)....3.\|.<........(.................................................................................................................................L.cb...Q:....W...e.<O.w..Y.{......V. ...)....3.\|.<........(.................................................................................................................................L.cb...Q:....W...e.<O.w..Y.{......V. .

C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	21498
Entropy (8bit):	7.426049555608876
Encrypted:	false
SSDEEP:	384:AKzFdzoScWm5/s1hwiPCOjJWq/89Nx7tJBAK8FCl1I:AiTi50djBSx5JBcFClm
MD5:	AA388778CC4257869D00C7C94C5F75DA
SHA1:	77376FD937123C5B151EBEA9844BB47071557DB2
SHA-256:	387CC5787A44969BE0B31E14A5D89E20DDB899E569B1D3EEDBDD962E49D93397
SHA-512:	D99AA6C6B57CCC5E37F8EA28015861F173B2C698F710E65F281F3243DB6A1C9D039262FEF6233D4FF613298668B97EDD454105B4826D5587E840D920293C055E
Malicious:	false
Preview:	UWo\N_.deN../.v...Q..3..qVcD.......#...<Z..1..0O..'.......E.h.p........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S.............\M_.`eN.L..v=Q.Q.W1..I.6D..........7X..1..0O..'.......E.x.p.................................0......K.....`.........................................`................ ...................<.....\M_.`uN.t..vm..Q..3..qVcD.......#...<Z..1..0O..'.......E.h.p.........................rdata..............................@..@.rsrc........ ......................@..@...........................\M_.`eN.L..vm..Q..3..qVcD.......#...<Z..1..0O..'.......E.h.p...................................................................................................................................\M_.`eN.L..vm..Q..3..qVcD.......#...<Z..1..0O..'.......E.h.p...................................................................................................................................\M_.`eN.L..vm..Q..3..qVcD.......#...

C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	19450
Entropy (8bit):	7.496335687338214
Encrypted:	false
SSDEEP:	384:YOatHOrWeW2sA7ShUQUxrxTYULjGEdHaiYqcewpoZ0mg:3UHZ9olEyuyOGrg
MD5:	EF0DB244BE8E197CEBB4B2745EE4D6E8
SHA1:	41ABA2987C116B9CBA5FBD60A80E4D7087D6F15C
SHA-256:	2B2E45C1E1559FCFFD78FC32146509666D07B654632E8A761F06BBFA9A13571A
SHA-512:	B82C5A004D40F65DB036163A0FA8339E776DEFF2622551690EF8C49210CB4914A900C46185D31DE90443B1956F603E7423F102FA5FB4D0B5A8F1979B2B269F40
Malicious:	false
Preview:	V$.o.{x..l..?P.]8......c..'A....< ......._X..M...[/d...v&2.........!..L.!This program cannot be run in DOS mode....$.......m2..)S..)S..)S....].(S....A.+S....^.(S....C.(S..Rich)S...........~po.{x..l.A-?P..]8.X.......'A....<...>...._X..M...[/d....62..................................0............`.........................................`...^............ ...................<...~po.{x..l.y-?PU.]8......c..'A....< ......._X..M...[/d....&2..........................rdata..t...........................@..@.rsrc........ ......................@..@.........................~po.{x..l.A-?PU.]8......c..'A....< ......._X..M...[/d....&2..................................................................................................................................~po.{x..l.A-?PU.]8......c..'A....< ......._X..M...[/d....&2..................................................................................................................................~po.{x..l.A-?PU.]8......c..'A....< ...

C:\Program Files\Microsoft Office\root\Client\concrt140.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	309442
Entropy (8bit):	7.099865046822276
Encrypted:	false
SSDEEP:	6144:Sl3IvL8YM+bU/mY58eGeo3+ZXA9NutILlerBnXnP1N:C3IYabUR53Ge+RuupmN
MD5:	2FAADEF6B62BB3A5E76FE4CEE40E1479
SHA1:	5522D4C18D59F39BE0C5D0BAAB9C1FD8785A70F3
SHA-256:	3C57D2A8D25B589B98A2392926A5AF894C2059E0A5E27D6774888702DD075CA0
SHA-512:	90013C3EB6D4ABB78EB8917BC1DED771E3BE215F087A2FF359F69DEE75416B02AAC379CE457B24710F871B9ECF7D2A3963A24D481A615C6E5D1685E67E1267EC
Malicious:	false
Preview:	.._....(._........g..%.ul.k.R.I.n.....(.........=k..................!..L.!This program cannot be run in DOS mode....$.........1.S._.S._.S._...^.Q._.Z...Y._.?.^.T._.S.^..._.?.[.[._.?.\.W._..........VV../b=.L5nY...1\9q.A........(......C..=.W..0............." ................0...............................................w=....`A........................................@....M.........(....W..]......%..h..R.I.j.....0...C.....=k..................p4..8............................................text............................... ..`.rdata..V2.......4....................h.;..eT.....g..%.Ml.k.V.I.n.....(...W..T=..\....U....{...8...L..............@..@.rsrc...............................@..@.reloc..p...........................@..B..............................(._..T..]...g..%.ul.k.R.I.n.....(.........=k................................................................................................................................................(._..T..]...g..%.ul.k.R.I.n.....

C:\Program Files\Microsoft Office\root\Client\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Microsoft Office\root\Client\mfc140u.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	5640898
Entropy (8bit):	7.300344980508214
Encrypted:	false
SSDEEP:	98304:uTP7kwzzv4uDvNho4EPUtnf4WUjh328uz+4lGjI:uTzkwnv4u7o4Rtnh8uy4lGjI
MD5:	AC5B8009F3A55D76BCD758E7911CAA3F
SHA1:	C4942229DC0993889156852956105EC09E33C35B
SHA-256:	C9FA95F9170495D86F0A932339CFD437ED642004AEC0568FDE7B74891A1A73E4
SHA-512:	AAE8CD730A6BD0BC88A634917CBF8A1EE9AFCB234CB0E83015540B082DB0E6841317390175803E6751DA7556AAFCEC134215D8AE0D6746C185C207F6628E994B
Malicious:	false
Preview:	.)l.2..9..w.b..N.:......q...-.....g..}.2A.k.)..&.......AF...........!..L.!This program cannot be run in DOS mode....$..........U.j...j...j..4....j..4....j..4....j.......j.......j.......j...iq...q?c....,lH.$`...t...M.0..;.Q.!{t{~,......8...ks...AU.,.Rich.j..........PE..d....B._.........." .....&-..,).....0W,.......................................V......(V...`A.................s.1..9..w..E.N.:......1...Nc-./{.....}.~..t<......9.....F..... U.,p....5.T...........................`...8............@-.P...p.:......................text...L%-......&-................. ..`....E..9..y....N.......1...-.....'..=.V ...)..........AF................@....pdata...8...0=..:....<.............@..@.didat..H....p?.......>.............@....rsrc.........?.......>..........s..q..y.....&.N.J.....1....y.....g..}.2A.+.)..&.......AF....................................................................................................................................s..1..9..w..E.N.:......1...-.....g..}

C:\Program Files\Microsoft Office\root\Client\msvcp120.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	660450
Entropy (8bit):	7.131019869846752
Encrypted:	false
SSDEEP:	12288:EMb8N4MHdgYrxWStHCE/qwxkMNtRB+hOimn+/AdEBLAif:nb859XxdnRBdimOAdEBLf
MD5:	57258385F3F440E03BB57F6AD9AFE83C
SHA1:	A95B8C0BB2DE60DAD7595B5BDCC0FDF4834104F9
SHA-256:	7CE293D12042AA93592FA985C26E81896A268193B02035162D463C17CF97C234
SHA-512:	1AD39FD3A10EFD7D12A22317B5EFCE1D308332D3E637CC28F480C87ED618E8D3F2B5A41564B1B739970AEBB5F5FF2E1A3DFD1B5CDFC6CC5E5AFD4E17ACCABED7
Malicious:	false
Preview:	..._%s..j...<$l....Sm.7.dbb......)..g..E..d../.E.\.~...C... %$........!..L.!This program cannot be run in DOS mode....$.......Ca.=...n...n...n..)n...n...n...n.R?n...n..%n...n.R=n...n.R.n4..n.j1ls,id.......A.=k..u.0[{..D......g {........E.\.~........#$.aS.........." .....@...................................................`............`...........................................o_..........l..S.S..7.$.k.W....R ._Y..E/.dQ./....\.~...C..} %$....................p............P...............................text....>.......@.................. ..`.rdata.......P.......D....h_&s..n....l.1w.'..7...b....)..%..E..d../.E.\A~...3..A%$.G.......H...z..............@..@.rsrc........@......................@..@.reloc.......P......................@..B..................h_&s..n.....l....Sm.7.$bb......)..g..E..d../.E.\.~...C..} %$..................................................................................................................................h_&s..n.....l....Sm.7.$bb......)..g..

C:\Program Files\Microsoft Office\root\Client\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	frozen file 2.1
Category:	dropped
Size (bytes):	564418
Entropy (8bit):	7.2316827121441625
Encrypted:	false
SSDEEP:	12288:J0ZzP0cNOL3oRdsJSV0wIO4hGvu5nns4Z85ezOrbEKZIADTMMdE6TWKx2:JwzaNl5s4+IKrbEKZIMYMdE66V
MD5:	89597A956DD63BF8787015186697550B
SHA1:	3CA481D9745EC73C9D8379741A5841308434C271
SHA-256:	D929D2418B0D82E1A31F16D1D2DF64140C8BEB6C832C0D59C7886E35BEC797DB
SHA-512:	D7837A719547F446DD074CFA71DC7AEA87B81AD165BCEA9C6CD09C9D24FA00FDC198FDF09B0E4184E074AE210872B5AE0FC4D0C241935447B178A950B44FDD27
Malicious:	false
Preview:	........c.....G..\|.2v...d..t.F......h.Pj+b.X....5..[..c..........!..L.!This program cannot be run in DOS mode....$........v..............}g.......o..........V....c.......c.......c.........>....Y.%..p..H..B.aa..._...7........Pj+b.X....5..[..b..PE..d....@._.........." .....8...Z......0$..............................................+&....`A................................R.<....\Q..(..G..t..w........F......h..Xj.A.X...5.\.^..b.............................8............P...............................text...L6.......8.................. ..`.rdata.......P..R.>......c..@g.G..\|.rv.N...~..F.....h.Pj+p.X....5..[..b.G.pdata...9...p...:...0..............@..@.rsrc................j..............@..@.reloc..0............n..............@..B........R.<.....c..@g.G..\|.2v...d..t.F......h.Pj+b.X....5..[..b..................................................................................................................................R.<.....c..@g.G..\|.2v...d..t.F......h

C:\Program Files\Microsoft Office\root\Client\msvcr120.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	963554
Entropy (8bit):	7.274616391491109
Encrypted:	false
SSDEEP:	12288:6maLmywVhE8eFp0rFExCdydtHkBqE0MjD3aLFE+tzhNRTVB5:6BCywVh1opDxCdydtHkB/MFE+tNT5
MD5:	6E8AEC01B9B853A563BEC18BF8009435
SHA1:	D1DD3FE332507BDE8A1105C2D120B99AD11D2F4A
SHA-256:	3FDCFDE59BFA967A8DE0242C4FEA9D6A39007545A895E58C287B3BCA47C76034
SHA-512:	9E8C1C2BDF21A02F05DAAB8F119C718F99157441ADA6FF5B11636639AC0ACB2726820C9A5BEBE970D4BC972F72217A26499FC6A7196F1FB11DB0D818BF7AD966
Malicious:	false
Preview:	(....t..U.../b...P..?8\|z......i.. .^.SP...Z..<t...<.7...!..q........!..L.!This program cannot be run in DOS mode....$........F=&^'Su^'Su^'Su..u]'Su^'Ru.'SuSu.u.%SuSu.uo'SuSu.uh'SuSu.u.'Su6!...6'.. .z^.1...7..X.J*.......i.. .^.....t...U.....<.7...9..Q.....h...:.......)....................................................`.................................................@...(...e...J.t.......b.R....A.?x.t........<.^.SP...Z..<t...<.7......q.2..p............................................text....g.......h.................. ..`.rdata...8.......:...l..............@..@K0...t.. ....o.R...P..?x\|z......i..`.^.} .wd;...Ot..2.7......q............@..@.rsrc................^..............@..@.reloc..8............b..............@..B................................eT...t..U....b.R.P..?x\|z......i.. .^.SP...Z..<t...<.7......q................................................................................................................................eT...t..U....b.R.P..?x\|z......i.. .^.

C:\Program Files\Microsoft Office\root\Client\ucrtbase.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	983034
Entropy (8bit):	7.305390910618063
Encrypted:	false
SSDEEP:	24576:lYSqAgJ3cTTPupWEr+rWD/hfnM1imzIJt6u3b1DWW9UCZeim0ZP0ycQqq:ODAcwPuUEU6/hSHu3b1DWW9UCZesqq
MD5:	9B5BB7AC411A8077EE945A68CD558A4C
SHA1:	460FF3870F86253DB4CACAD1CB35433CD9AD8931
SHA-256:	109D02D89A327560658E532DB8C8D6DF973BF1DD73107C6C6EB7A52D626CBD72
SHA-512:	C716E7C1D795A73CC3248AA319F7B33DBE7E7C0C5D9C50D1DA197D0DAA3052FC0D2DF14F7D8558ED4E7CEB725E7426B56E532D4491AE36452B26B546F2D0CCCC
Malicious:	false
Preview:	^+J.<...7.:".$l._....\|.a...q.~ J..l.j....%...D..-.,.:y`.sZ...>$.........!..L.!This program cannot be run in DOS mode....$.......b...&.a.&.a.&.a./.....a.&.`..a..6..'.a.l..'.a.l....a.l..p.a..Gt)W......9+.Fug..$.........A..w..L..".%...D..-.,.:y`.sZ...?$.PE..d...Q8.U.........." .........N......`........................................ ......s.....`A.................................q./....7"..l......~.a...q.z J.Nb..X.....6x..-.#..s`...?$.........................P...................H............................text............................... ..`.rdata...u.........?/..3.:"S.l.....C\|.!..~..~ JP<l.j....+...D..-.,.:y`.sZ..n?$+.pdata..p....P......................@..@.rsrc...............................@..@.reloc..............................@..B.........q.?...3.:"S.l......\|.a...q.~ J..l.j....%...D..-.,.:y`.sZ...?$..................................................................................................................................q.?...3.:"S.l......\|.a...q.~ J..l.j...

C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	331458
Entropy (8bit):	6.90425013914001
Encrypted:	false
SSDEEP:	6144:ndbMd723PQKWAXUMviBIioXuDFDsVOgywoHu6CVX1t:dYdUWPMvgPoXaZ/Pif
MD5:	63C9D2C26B94D4F7DA99561F76D08982
SHA1:	89C48E1E4E2EA3DF27A3574AE6F513581853C452
SHA-256:	9EE90476420A2EAE9227F7C3770926FF1116A037A25EB5DEA8351EAF6F824B0D
SHA-512:	B390D50D5F7C10C38EA2622F7357257BA8A517391F9C3D752F6360992B1D3A7D4B98AEFA66E16A0576EE2821313DA15FB8B06DE66CF5A2F45BC015D9BE573DED
Malicious:	false
Preview:	.K ...\.T.y.R....Ju..d9..+s..a#-..v.........v..;I=..X.G.V;>.........!..L.!This program cannot be run in DOS mode....$.......d&.' G.t G.t G.t)?it0G.tL3.u&G.tL3.u:G.tL3.u(G.tL3.u$G.t.7.u'G.t.VK....g1....5LW?T.^.5.`.m..R.X.......{1..v..;I=..X.G.^:>.........PE..d....B._.........." .........l......0}.......................................0............`A..............................\.T..^R....J.d....+s..a&-..v..q......v".;....X.B.. >.P...T...............................8............................................text...f........................... ..`.rdata..Cl....^....P.y..Ju..dy..ks...BY..v.3.......vl.;I9..X.G.^:>.....@....pdata... ......."..................@..@.rsrc...............................@..@.reloc..............................@..B......\.T..^R.y..Ju..dy..+s..a#-..v.........v..;I=..X.G.^:>.......................................................................................................................................\.T..^R.y..Ju..dy..+*s..a#-..v.

C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	96450
Entropy (8bit):	7.153991313161171
Encrypted:	false
SSDEEP:	1536:OY2jbxVy94Qk4uBFGr2pb6PFOfHvYdY9CfwrQiiG8Alkkucb2C/KLIrSuxY:OBXnq66P0Hv+Y91rQVAGkucbL6jIY
MD5:	4F3AA6B4576F5FE8B3EF2B700927CD1B
SHA1:	69EA2C45A5733F65B9327F066F42107F6F4B3C6F
SHA-256:	7B718662B9CFA653E3D73850BF553B46197473EE8AF47232EA024A78D6FD41A2
SHA-512:	2B9956EF68885AD7735DF1B8F9F591D6EF44C462C028B5FB05F8B35F1942ABF51C1787BF704444B520F822DF7FEF5EF91324E186E69BE98C74BBE519F33C18A9
Malicious:	false
Preview:	\Bh.......\.4.i.m.".....L..Pa...W....E Z....H?...E`.u.l:_..t.........!..L.!This program cannot be run in DOS mode....$........T.r.5.!.5.!.5.!sE. .5.!.M.!.5.!.5.!.5.!.A. .5.!.A. .5.!.A. .5.!.Yn...L...5.]....E..K?@'^.8.4..W....E Z....H?...E`.u..):_..s..@._.........." .........^......`...............................................c.....`A.........................................Y..".....].G1i..#.%......P-...W...Mf Z.....>....E4.u.l:_.t..................,..8............................................text............................... ..`.rdata...?.......@................\..1i..`C....L..PaQ..W....y!Z....H?...E .u"..^>..t.L....`.......@..............@..@_RDATA.......p.......L..............@..@.rsrc................N..............@..@.reloc....................\..1i..."....D...Pa...W....E Z....H?...E`.u.l:_.t...........................................................................................................................................\..1i..."........Pa...W....E Z

C:\Program Files\Microsoft Office\root\Client\vcruntime140_1.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	37058
Entropy (8bit):	7.101073745465805
Encrypted:	false
SSDEEP:	768:0LCRv51gi0MXblE/DS1rXC5XSXgx5ez1LGFEufkYb6:0OBgrMpDdXASwwdGK6kA6
MD5:	4FDE434F3EBFCB64379C72ECBDA4B356
SHA1:	C2C9099BD57CB602A6170A8B6DB37978E9BF3DF2
SHA-256:	46CA633F9C2E257F0F752BBBB3CFDDBA6C9B4BB45E2D8FAB1A723A05A1AE7C35
SHA-512:	2B62F66E1E6170BA480DD0E2F1249CF152568643EAAC632CE87078A93855833A333C3F4163D25F66BE2FFD15B9F471CE62B4AF24A9CE5C6AD4DCD4B0080180A4
Malicious:	false
Preview:	.:.e.a;.Yg.);..,...5?..........b8.yO\|.....,.F..Q..........=............!..L.!This program cannot be run in DOS mode....$..........@..@..@.....B..,..B..I._.K..@..q..,..E..,..G........l...;.a.D....t.B4...K...N0Q....p?...,.F..Q..........=....PE..d....@._.........." .....:...4......`A...............................................O....`A.................................`%e.a;.02g.Z.......M?..........b..y.....a.,Oe..Q0.........=.............................b..8............P..X............................text...u9.......:.................. ..`.rdata..P!...P...B%e._;.Yg.........u?..hb.....B?.yO......,.&..Q..........=.....pdata...............b..............@..@.rsrc................f..............@..@.reloc..<............j..............@..B.........`%e.a;.Yg.........5?..........b8.yO\|.....,.F..Q..........=.....................................................................................................................................`%e.a;.Yg.........5?..........b8.yO\|..

C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	738743
Entropy (8bit):	7.907739123280288
Encrypted:	false
SSDEEP:	12288:xrvMSDvLvvEPpdVbhPc0v3bw0uMDmMU8XH7I9C9xbnyHEv6es:xrvZsPrVtZ3bwQK8kc9FnyU6es
MD5:	DA5FCED007CDB11F312CACC380EBC3D1
SHA1:	5C832E3BEE3EB26FEC4D2649D3961D24D4F8DA1B
SHA-256:	DABF7F3731DACEA4C4A103C84CC44D68D4C219EF4B52C697919011B6549A4F01
SHA-512:	0A51E1DF5446EBF21DF5340255FF046AA8D75BEBA5CAD7DE3321B6D537275C7927CF0495A6537642AA723FA06B9F7CAA20946F6071FD389556EC5B8F71EF6ACD
Malicious:	false
Preview:	.@..Z.^\...\0..0u&>d......-....!.G......R.8....Z.B)9..l.aQQ..$..,........-..g@.u.G.+t.:......A1......=..._..d.....Y:.B...t.e.8]..].....s.M.=.....6...&Z.D.?.u..,."Q.].. W.....p0..Q......#G...-.F'..(@8..... .`..}F}...Y.#=(T.\7......\|.2...o...<<c.qnn...8.:.B9.."^...U.Oq.....>..-]..O...-.q..Y.M...:.M+...}..y..{.0..V'K6.K?Qqz........c^..~GN.s_..Q=g[k.....8..XC...?.t.... ...V.q.......W.^.b<..Q....>.B.>...."T.Ku..X+....%...%[.v{&.......q.=.[.v{....k.5.........4Y9..3Y).....v..mi...Wi.~.=G.....t.?.S......bB..H.%X.W..r.>.... .W.\...rU?.++i..&+g.b. .D.i..P...q'..Z..gb...&.c...AM,+.X....q..{.F..LZ..i.9'..F..B...++i..&+g.b&+e\..h....r.V..^.JZ..j`........bB..H.%X.W..r.>.... .W.\...rU?.++i..&+g.b&+e\..h....r.V..^.JZ..j`...[..u...UN -.`A\...M......#.~s~1a..1..k}.'...%.............V.........<.l..T...UN -.`A\a..U. .W.\...r5?..U..............q.....,D.%X5Zz.i.....C..d...&T9..\..q...W.\...r.?.... .W.C...&+h.r&+f.R.%X..Kp...9.Q...h...[>G.5...6...Df4A_.t..Y

C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1526448
Entropy (8bit):	7.977321984108149
Encrypted:	false
SSDEEP:	24576:BhBS+FFLX/yf1YunDCGas03dAQ7m/dicxskKvUnCdfKHnOYBZDnUJK7PU/:B/ZNXU1jnDoeQ7mNphCfKH/BZDnUJK7a
MD5:	1A5E978B7BC03E3ED54539401B8DD0EA
SHA1:	39E792979844FDC128127D254EF8AB6B58094851
SHA-256:	DA93D5EFD2A9C676E73D2FD2DD1DD2158035017436B4D218D0C123D3DE50CB6A
SHA-512:	FDB7F1ABB37D17983434688280CD9E20D8EBD8095C6E1798469093B813D4CD21B122B67F73EC05BAD91AB6916506D85D56DF161E8CE17C1F067F09981CAF3347
Malicious:	false
Preview:	`=.0H.a.l...O..-).s...p....9i......I..1......".f.[.Q.U....T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q{..E...(.4..>..y,.>..~&..b-.a.?..4aD^....E./(F..C..:.....\...d..u.M.....[.=ma.1.B.....{p..p..%..#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...'3.g...T....d..g....u.3.R.h...4...7.,SH..=.v..~.k....*).d.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G....:e..X..Tk.R=_k.......Z.c....c.K..n.7}n.&.[n..L......6V.N......1_Bu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}2.S.[{..J.J./...n.......C..>T.Y..U...0).Q..2$.>...^i!.+...8.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK.........qMG.s@.....O......._rels/.rels...J.1.._%..d...D...B....\q...Q..X.....<..np.........

C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	3446502
Entropy (8bit):	7.971304126790984
Encrypted:	false
SSDEEP:	98304:q+6mL3zfsn/oViKdxto//RzPEUaBdF//QOqh+y8uLN:q+6m3s/oVljt8RgUqFwOqh+yfp
MD5:	192BD25592A2F6FD7A6D79678F2F0AD5
SHA1:	8C9DE12F2AB4B5723712B92909DE4CFC0103D8AA
SHA-256:	95E012A42EAFF1EE9FDE5E9F34538CEC1C0D41176280796ED140F23F7897B4FF
SHA-512:	231A96BA5894E58F40985F0851B1108A1CF4992DDE95B77A69C2C082AC2E6B7E39062BA2198D0F7584318C150A6BB307D2C968145E417197C64F10CDD70CEEB6
Malicious:	false
Preview:	]..j.....wn..(.-/C..}V..D.U.5&.D..z...."#.E..u.P...C.;.. ..R.v..p.gh..$d...^../.[0.e..=d....B...c.._?~._>$..}...2.t]...D.ty...I........._....T.M.I..,..APLo.$,z.,J.wf.<...e>..p.=.G....k.........\.....$...=.G..?..(.y..$3...YG._...{.,....m...>..I;....\|.Lq.g....]..g......~>W.<....0/?.I.....g...U.V..3....l.O........m.l...T.....h.GE.......'K....$...z.E..(.Gc.......0~.U.Pgj...Y..B...G....1.....o.Qr%N>d.o7R..f..Q......o...s.....k...l.k....K.Z..i[..7mk...m._........~.../.^...{..Z...r@........P.@.....Z..d....R..e.O..jY.S.,..Z..T-K}....Z-^}.}d..1......LZ.9.Hm.........=.r.HR0.YrK..^.`D.RF.`w.p.3......s.v_C.C}C...*....Y.R..uwY.S.,..Z..T-K}...>U.R..e.O..W..o./-o.kha....N.LP..e.O...,..Z..T-K}...>U.R..e.O..jY....w./-o.kha.odN..k.X...r....h........4>!..IG...x...m_...g:P._^.....V.v.Jy....9..,..\[w..>U.R..e.O..jY.S.,..Z..T-K}.Z..N...M}.-...m.o.`.zNd-K}2...e.O..jY.S.,..Z..T-K}...>U.R_............3..;S0A='....e.%bn2`.....h.......=1z..j.-...>r(

C:\Program Files\Microsoft Office\root\Document Themes 16\Ion Boardroom.thmx

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	1595173
Entropy (8bit):	7.953041832223107
Encrypted:	false
SSDEEP:	24576:EOLsIjnQL2eAE0mKBu0RrToez0uwgrwlfjs9hH/x1Wq9/nYeQLZqdf/wWrXY4X4l:EOLrQuEZyLTzbwlrzEnYeQqTQCAVW6
MD5:	6498CF1F586C1E7F6027A3C00C6E7A2D
SHA1:	CF877E892926FBCC1DCFD992529D0D6A7FB463A1
SHA-256:	545489911FDD6AB8D64A8585E8A558CD28037687BC02F6B2D23AD9D09EE86730
SHA-512:	BE6E0E2AEF0CCC89C04467B2EBF1347C41C783060AF806E3CC77978C83FD0A75110B98A0356A29E55365299A460F37095500329E6506BA158A297BE5695E345A
Malicious:	false
Preview:	..8<Z...Nl.=G...#w+.[....O..N.n.[l..b_Yw.l....xSP1.f./..t.}/.8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A\..u...(..%.7L9.y..........=...9.r;.... .^.....,..o..H......\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS....}..-...u"...wT.{..R~>vv....yJq.Q^..!..)[..k'.v.5c.....[.L..0.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\......'....{....Z........9.q3Y.....A."...ipt>....zI..o..]...>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.K).7.kj.MxT....f........ n.......=...KU...2..........3..Fiq....r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...J.<.........wk..pq."dF..^2Gu.....i.

C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1837845
Entropy (8bit):	7.967617205968182
Encrypted:	false
SSDEEP:	49152:iHGxStyNByzvrV64e+Dxn7EeNp4n0ivgflh/:imDujrALoxnbdf7/
MD5:	02EEFA8B06E8CCC3CBEBDD2C6E3175C7
SHA1:	D736591B007558F5A33B12F49C09A4DE66728E15
SHA-256:	971EF4D91107BE2C83110263F8F4FBF4574A8AAD99668BF323B739BF89665DAE
SHA-512:	71E7AE9E8E13D925CB3E657F497E766262C19F69A03DFF53BE42B39CADF915BD2D843BF05D995302194517EBFA95ADAA016F49F2FA8F47892F16EDF8C776BC4B
Malicious:	false
Preview:	.9Y.W.......w..[J.X.....+...B....../."....hnx..,."..-.5m..{.8i.'......}.......(y...H}......3Fi..%.......3..._...j.`.2....cod.(...r...w{s..)...]..3..APF.61...6ug.Y...... 7.....d<............Cr).f9s...O.l.....(,......f..t ;O:.%l..........J;.\...;.<..os....n....>...w..%....P...v...v....'....m.m..3.[.._...:[,...h..!~s..^..Y..E.....^.9Y.j.....#x......3....=....b}4..._...y...A...;....x....cb....q.;dlr:....H~..C.2...A!a(....!=...9..!L.0.v.gEo\.......w..No.a.C.q.}<.........a..n./......e.-)h9a..}i.}.."-..C.C.Xq..0?..M4.........r.A.+..\...r.>.....\.~.3...;..m/.. .{3..y..y^.....B .'......%.u!.6j.....D....}t.Wlw.b....}..+.A\...q......~.WK.Z^..........>.h..`......}......k..s.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r..._'......M..:..\|..x..........\|...jg<.AX.j..4~s l...LG.5...ZV...... ...-Z.>X.2.....>8..S.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G....(.P.'....B\...}.......k.{EK.C.!(...z.....j.....t./...J

C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	324936
Entropy (8bit):	7.859484367699226
Encrypted:	false
SSDEEP:	6144:P+w284Hxjmmk5/LNGrLGdN8NhFp0drbyw7cEEwgAopT5Il:WwT4HxSB/oraoNv+rmMcE2XzIl
MD5:	07FED446A103D21594995C2F87A84A92
SHA1:	55DD73D5D6C1366210A79FB294B7B93279DA7710
SHA-256:	4AC4FEE92EF02BD2D51DB3756614EE421264FDB0EED8D71065E1550B784C315D
SHA-512:	D5215E168A9F1A43AC94566924A69DE5C32C2828D2386ECB2CFEFD39CA9A01BFDC8B4A75B594FE8DA12E5AC1D908C7A645D897DD8F8C3492FDF8F73F9B064F46
Malicious:	false
Preview:	.@ f..c..0..tQ...V)E.....`.....P......6T..'...7.."......6N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.g.m....Q..........w.R1M.....9.wR.x..dT..{.qbI..BnR._r..-.........1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.dH3z.N.....Z.N.].Q....;..]..0..\|.o..X.S...x..T<....6H.....mZr.sv....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZk.`8..&..........Pp...YP.3].x...T,...1EH....o.P._>.i%.r..hl>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..o5...=.l..zr.).$.X...u I@.'.D...(.k`.....usv...i.x.......2..#,CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK........$c.F.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..v.m>....2........r9pY.q.A.#..4.......

C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1623574
Entropy (8bit):	7.931715937693094
Encrypted:	false
SSDEEP:	24576:ysWdsDZTC10Qgg/D+/GYqWy1TqTzbTviqu1vc1MPCc+Wc0bPaN5XAgSg:yVaDZO10Fg/fTNquc6Ccbby/XZSg
MD5:	F7215A21A8D859BDB6259EE3F3F1C94A
SHA1:	CC3A44B2B1D744163860D8C8DB1E5531765EF3F0
SHA-256:	387F39646559DDABB0C22689BA5AEA8EEED468BE303E9E40E2DA2575D1403C31
SHA-512:	707B53763EBF5F3FCB8272BFA5FF4777CC196F00431363BF3351F4C86C5786194598EFE9E1D414F0E2946311420AB76052DD83839467EF7E0F13D9481D8FF402
Malicious:	false
Preview:	p^D.x....M...@J.f.....4.{.bU.,.YYg........f.....aa(..S...A^.t~.R.v..p.gh..$d...^../.[0.e..=d....B...c.._?~._>$..}...2.t]...D.ty...I........._....T.M.I..,..APLo.$,z.,J.wf.<...e>..p.=.G...X....B....,.<h.\9..k......5C.@..>.....Yn. (....E..]rX.!e..h..>..I;....\|.Lq.g....]..g......~>W.<....0/?.I.....g...U.V..3....l.O........m.l...T.....h.GE.......'K....$...z.E..(.Gc....y.B....t..e.j>M ...1....\{..8....$t.Q...Z..Fpt....Y`..O.y.o...s.....k...l.k....K.Z..i[..7mk...m._........~.../.^...{..Z...r@........P.@.....Z..d....R..e.O..jY.S.,..Z..T-K}....Z-^}.}Il.S/..y<..-N......e......:.zn.Q].0'E...b.\|........f.-...(._C.C}C...*....Y.R..uwY.S.,..Z..T-K}...>U.R..e.O..W..o./-o.kha....N.LP..e.O...,..Z..T-K}...>U.R..e.O..jY....w./-o.kha.odchd..Q.&...[.o~..;m....fG...;..G[.....z.k.CK.a.J....F]^f.\..+...9..,..\[w..>U.R..e.O..jY.S.,..Z..T-K}.Z..N...M}.-...m.o.`.zNd-K}2...e.O..jY.S.,..Z..T-K}...>U.R_............3..;S0A='...+.g.k..\..............l.N..7...R...e.F

C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	865124
Entropy (8bit):	7.912754407236701
Encrypted:	false
SSDEEP:	24576:cK8gEpK17BVpPE4pCSxZCCZSKRz85LHicP:cHgEpolXPE4BZjrRz8HP
MD5:	50A70B60CBA0435E269C3F881E2E364E
SHA1:	5A6631DCBA1574537A76DDB5E7994915E721487E
SHA-256:	1B716784CFF0B43F3D1EEF927A158B4097C7B01102B06D8E9053F62D77536224
SHA-512:	757F8E0B68AE693A3FE08DC7E10A39210FF52037A44633851C6EA5A8AD3AFAF8AF48B3EAFC8E82E5E1DDCB5547080FFC77957EE9789DE118C5BADEBBBA6CE85C
Malicious:	false
Preview:	mr65e_W ..,.e..d.."...ji..+<......'..\|.....;.7.g.....}...]...8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r..*.M..l0...A...\|.;..w......=....p..N.Ad6.RT..h..h=.m.5..A'..}l..W...nP.&6..\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS.....".$)L...Nc.4...R.l,....)#r`...p1..c..:..\|.?..3..p.......Q..0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...L.....C...{..=.n(..;..!C....iUXd....v.+...Yj.\.....N.IV836.Hu<t>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}....>/7.......K..\|...%q.w.7...~.p.C....5b.f_.o......P..#`......r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\.6.C4`......@9.....".JXy.dA.k..O..?.;J.

C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	772347
Entropy (8bit):	7.903282622441874
Encrypted:	false
SSDEEP:	12288:rbDZd1VFveZvs3J9esM+Uq3zKf98kGQSzFvcUVkrMDLQG19E8gMTzTyCiNNpFBf:td1nF3J9esMiefekGQSzFJV0G+6od
MD5:	87DDC6002EE78AC54325A99F9DB64B01
SHA1:	EBB446BFB51A02F4483FB892C3BF5F75140C2865
SHA-256:	3D21F2F94FD35ED41132549BE2D78ACD5A6D84D09F799373E323B79703E1D12E
SHA-512:	24FDB60FDDCE596F0DC7EF3CA10AF036290C8E1395AF8BD1F0DA53326F2967DDA8DEAFF8F1FC9B85EB98403A3013CA9F2ACC611A21BDFB0D7B7E9B27ACB7A927
Malicious:	false
Preview:	...)X..E.Qkd..0.b.O.{.....D..'......'..s.vF\|.[....:.C..z...r$..,........-..g@.u.G.+t.:......A1......=..._..d.....Y:.B...t.e.8]..].....s.M.=.....6...&Z.D.?.u..,."Q.].. W.....p0..Q...2...A.l.......A.'v.EU..H....u..,wf....O..jl.....'.l.:....<<c.qnn...8.:.B9.."^...U.Oq.....>..-]..O...-.q..Y.M...:.M+...}..y..{.0..V'K6.K?Qqz........c^..~GN.s_..Q=g[k.....8..XC........]Bx/...#yuX........J0....#w...ly.......b....[\D....C,.H[.v{&.......q.=.[.v{....k.5.........4Y9..3Y).....v..mi...Wi.~.=G.....t.?.S......bB..H.%X.W..r.>.... .W.\...rU?.++i..&+g.b.v.q....Z.........}A......f...(..:f+...Y.:?..u.N.:..&..m.++i..&+g.b&+e\..h....r.V..^.JZ..j`........bB..H.%X.W..r.>.... .W.\...rU?.++i..&+g.b&+e\..h....r.V..^.JZ..j`...[..u...UN -.`A\..#x.3..$..J...c.tf.}.E.i.N#...}.....U...:).M\.m.O.......<...9...UN -.`A\a..U. .W.\...r5?..U..............q.....,D.%X5Zz.i.....C..d...&T9..\..q...W.\...r.?.... .W.C...&+h.r&+f.R.%X..K?M.,........K..W.....,"7..HA...N...@w

C:\Program Files\Microsoft Office\root\Document Themes 16\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	41274
Entropy (8bit):	6.108980398333808
Encrypted:	false
SSDEEP:	384:1P4odU8HQ9tb5M6eaPJViKjrav9c6P4/leyfIFonNBj:15e8HM/NjiK64cSNBj
MD5:	6C3B4AEAC435BE40097C4A788875FBB7
SHA1:	7F3349FCFD392C9E017BE5A147D7564F0C137AC8
SHA-256:	722A478FD7DF2062181C3FEF0A9928BC1C7F7B098D66937B1C7A6207668B5D76
SHA-512:	94709C720067CA2B3D9EA8872F7E4C046B8134610ABE4F0C7A492C79114DF8FFF8599E1B2D66FA9DDFFDE99ADAE8A44A59A886C75C8C26C570AB254810ADAA3B
Malicious:	false
Preview:	.m..:].N..Pp.=Mp..p./..i..n...Z/.(U..m\|.;.....P..K.p.,..jb..:.....................................................................................................................................t.._g.......s...Vu...'..X..z.........'{....p..F..[.......................................................................................................................................t.._g.......s...Vu...'..X..z.........'{....p..F..[...................................................................................................................................r\|.i.G6N..Pp.=Mp..p./..W..nJ..Z).(U..m\|.;.....P..K.p.,..j`..:.................................................................................................................................r\|.i.G6N..Pp.=Mp..p./..W..nJ..Z).(U..m\|.;.....P..K.p.,..j`..:.................................................................................................................................r\|.i.G6N..Pp.=Mp..p./..W..nJ..Z).(U..m\|

C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	163760
Entropy (8bit):	5.614801136658436
Encrypted:	false
SSDEEP:	1536:pe1OI4VluS74lV7Ba3Jcu4t697VcnG7yYb42O0b3YQRoIJq/:pe1O51MlVNa3Jch6RiG7yYbhJM
MD5:	E24BF76FC80C84D23737726B2ACF93EC
SHA1:	EBA629BC01A830A782567E23C07FC7E2B572707C
SHA-256:	267E3E769B6247E2E49784BF2E500DE6492D1A59C842FA3626375C14D514CECD
SHA-512:	9C3B63DD1CBB727AC20E6FBF555FF6BFC9EC69480AC32E0378842A16C54EC9E427FBA7654D4BEBE69D8C78B018AD7C2D4FB0C4DC86760F9AF3379F1C7F4A1675
Malicious:	false
Preview:	...r.8.......TO.&.'......!...BBD.[..C.<._.o.n2,..f.}.&...C..W.T.F.-.1.6.".?.>.....<.P.a.c.k.a.g.e. .P.r.o.d.u.c.t.C.o.d.e.=.".{.9.0.1.6.0.0.0.0.-.0.0.0.F.-.0.0.0.0.-.1.0.0.0.-.0.0.0.0.0.0.0.....\|...1......O.&.'......!F..BND.[..W.(...?..2I..fW}.&<..C..k.s.h.C.o.m.p.o.n.e.n.t.L.i.s.t.>.........<.P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t. .P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t.I.d.=.".{.5.8.1.2.C.....\|.m.A.....O.&A'.....D!v..B5D.[..Q.]...G.92t..fR}.&z..C....". .Q.u.a.l.i.f.i.e.r.=.".e.x.c.e.l...e.x.e.". .C.o.m.p.o.n.e.n.t.I.d.=.".{.C.4.A.C.E.6.D.B.-.A.A.9.9.-.4.0.1.F.-.8.B.E.6.-.8.7.........D.....O.&F'.....(!D..B7D.[....!...#.-2...f.}.&<..C..?.".E.X.C.E.L.F.i.l.e.s.". .K.e.y.F.i.l.e.=.".%.S.F.T._.P.R.O.G.R.A.M._.F.I.L.E.S._.X.6.4.%.\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.O.....$.#.......~O.&-'.....G!q..B6D.[..].3.j.t.o2/..f.}.&...C..r.o.n.e.n.t.>.......<./.P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t.L.i.s.t.>.......<.C.u.s.t.o.m.E.x.t.e.n.s.i.o.n.L.i.s.t.>.........<.C.u.s..... ........LO.&.'.....'!U..B.D.[..$.

C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	101418
Entropy (8bit):	5.6125770138118165
Encrypted:	false
SSDEEP:	768:Plkt7exkgRdJSoGzuo6rs7cJIGms1ltcofVHhD:9k5rgRdJSTuo6OG4k7cotHhD
MD5:	CCEE304A832A4A71D0BE276F13048EC1
SHA1:	411969A6EDE882C30F0AA80B6AA309046273D815
SHA-256:	1D76347980B5AAE780410310E19F479CD0B3E0567442EF9914B1979C291BACCD
SHA-512:	C69B48642FE983BD50A9B9040A4904DD4C867B52632871DFDF00A16F218D6C69E26ECDAEC63BC7BA44D93C721EC698346D08ADC7A48861D047A20B3ABB4341EC
Malicious:	false
Preview:	f3.^9S<<.\f8<r.E.(.......@xI....t)....@,eh....Z..~.Ez0.....ACc3.T.F.-.1.6.".?.>.....<.P.a.c.k.a.g.e. .P.r.o.d.u.c.t.C.o.d.e.=.".{.9.0.1.6.0.0.0.0.-.0.0.0.F.-.0.0.0.0.-.1.0.0.0.-.0.0.0.0.0.0.0...^7S.<.\w8>r)E.(.......@yIV...x)...T,qh...4..~~E/0.....A.c..s.h.C.o.m.p.o.n.e.n.t.L.i.s.t.>.........<.P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t. .P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t.I.d.=.".{.5.8.1.2.C....^7Si<.\98Zr9E.(N....@;If....)....R,.h.......~6E0.....A"c..". .Q.u.a.l.i.f.i.e.r.=.".o.n.e.n.o.t.e...e.x.e.". .C.o.m.p.o.n.e.n.t.I.d.=.".{.8.2.6.5.A.5.E.F.-.4.6.C.7.-.4.D.4.6.-.8.1.2.C.-....^0S.<.\K8.r1E.(M......@4I....5)....,1h.....~WEU0.....A.c..e.=.".O.n.e.N.o.t.e.F.i.l.e.s.". .K.e.y.F.i.l.e.=.".%.S.F.T._.P.R.O.G.R.A.M._.F.I.L.E.S._.X.6.4.%.\.M.i.c.r.o.s.o.f.t. .O.f.f.i...^ZS.<.\l8urjE.(K.....@XIa....)...L,.h......~KE<0.....A.c..s.h.C.o.m.p.o.n.e.n.t.>.......<./.P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t.L.i.s.t.>.......<.C.u.s.t.o.m.E.x.t.e.n.s.i.o.n.L.i.s.t.>........^:S.<.\y8hrfE.(?......@xIW...)....,,

C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	109228
Entropy (8bit):	5.583399753483363
Encrypted:	false
SSDEEP:	768:Kxader0nMD3HkDDfYvrcqhZBp83rdSLYPFT4roeDkPxK37N+dboPdlTv0j1e:78eEJhuBSL8hmoykZRdsdlTv0Ze
MD5:	4EDC1BF01901421589CD5AE32644FC0B
SHA1:	DCA08BC5D8C09199DA5FBC57A31E670E8BBC93F4
SHA-256:	1BA9C13525DCE8697DFF688FCC91385618396576BF470BB428BBE4C64FFE61C2
SHA-512:	B09779226F8E5C538ED8B02C680FCC54DB71784280669429D8BB22F236ED86C980BB9600F300D7A72A1C381C7CF3FABC696A880FD26FE3387EAFFD2642F506E8
Malicious:	false
Preview:	\...y.....R.;N.9.H.................(.E.i;0..v9...vx.z.\...wT.F.-.1.6.".?.>.....<.P.a.c.k.a.g.e. .P.r.o.d.u.c.t.C.o.d.e.=.".{.9.0.1.6.0.0.0.0.-.0.0.0.F.-.0.0.0.0.-.1.0.0.0.-.0.0.0.0.0.0.0.."x.w.....C.;....V................H..(.EHik0...9l..vF.h....ws.h.C.o.m.p.o.n.e.n.t.L.i.s.t.>.........<.P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t. .P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t.I.d.=.".{.5.8.1.2.C.."..w.......;..q......I..............(.E^i.0...9$..v"...V..w". .Q.u.a.l.i.f.i.e.r.=.".o.u.t.l.o.o.k...e.x.e.". .C.o.m.p.o.n.e.n.t.I.d.=.".{.7.C.6.D.9.2.E.F.-.7.B.4.5.-.4.6.E.5.-.8.6.7.0.-..".........;..l...............t..(.E.ih0..;9E..vs.\|....we.=.".O.U.T.L.O.O.K.F.i.l.e.s.". .K.e.y.F.i.l.e.=.".%.S.F.T._.P.R.O.G.R.A.M._.F.I.L.E.S._.X.6.4.%.\.M.i.c.r.o.s.o.f.t. .O.f.f.i.."[.......X..;[.9.....1..........{..(.E2i.0..'9Y..vF.h....ws.h.C.o.m.p.o.n.e.n.t.>.........<.P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t. .P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t.I.d.=.".{.5.8.1.2.C.5.7.1.-..".........;..k.......8.........v..(

C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	4148
Entropy (8bit):	7.144755476765148
Encrypted:	false
SSDEEP:	96:YUslu/CGT5jTQVX65QvySlRMEAu2+Aj8+N56/AnCSYg58Oqz:YUso/Ca5YVq5QvySlRMn+y8u56Rg58zz
MD5:	36E2B8433943C92C1FD179294B799177
SHA1:	D040AB340DF4479AAACC0FA00C35F6C9C5B654B1
SHA-256:	346892AAE907105D3E99BEBED8F1880E9379D06AE20A00552269E7B3A8E92AD7
SHA-512:	5A669115E7B2725B4178FAC34D1A8086769E12B59FBD2B2CBE10CFB13B189D64084462E70D92314A5DC03EFED91135BD530CFD194670CB48388DF05DF9781AC0
Malicious:	false
Preview:	.}....,.(..P:..j...}.m..l...\.F.$Q.<.M.'kk.(<.....>.#..L!ss<q....e.s..P%..jf..2.T..l...\.F..oQ..N...-ka.><......?. ..L>s.<^.....e.s..P..j[..>.4.Zl...\.F.:Q.3.\.rk5.{<.@...`.t..L3s.<c.........P8..j;..o.p..l...\.F..(Q..(.Y.`k;.F<..y.....!..LvsC<K....0....Pn..jU......cl...\.F..~Q..l....kl.8<..N...Z.M..L.s.<c.... .0..P...j-...o.p..l...\.F..7Q..[...!k`.'<.........LlsQ<@....=.3..Pn..j...k.w.Hl...\.F..oQ..j.P.`k@.3<....... ..LjsH<c....1.6..P$..ja......cl...\.F..zQ..p...,kq.k<..... .+..LfsH<Q...i.g..P...j^..<.F.Zl...\.F.KQ..3.Y.wk@.~<.H.....q..L1s.<g.....m....PX..j[..s.&.Tl...\.F..gQ..q...'kk.?<.}...Y.M..L.s.<f....$...P...j...M.k..l...\.F..dQ..W....k'.0<..A...a....LAs.<......e.v..P...jX..#.=.Rl...\.F.KQ.+.Y.sk3.y<..3.....9..L=s.<....9.5..Pt..j...0...`l...\.F..6Q..q...2kj.%<.....p....LnsV<J....:.1..P~..jI..>.6.(l...\.F.OQ.._./.zk@.f<.4.....i..L:sb<......f.t..P..j...O.2./l...\.F.6Q..].../ku.$<.....$.z..L.s/<,.....h....Pw..j...k.j..l...\.F..zQ..p.

C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	118806
Entropy (8bit):	5.580262825717277
Encrypted:	false
SSDEEP:	1536:BF8Kzk+ukX8A2H0fA2gaQXWSmoq5hjPB201:ot+NXJ2z23j7hjp201
MD5:	4D71FCCCA590B2E70B499472B21633E2
SHA1:	85BEF7B74A332BB5819F745C623B08CB18ACFD34
SHA-256:	DED95458D80F0DB94F996EC1A6C4ECD5DD89EF44FB20DD8D53F12C92193BC8F7
SHA-512:	13738E9542488A9C96A7B361950F827F4A731391754404185A198CE957C199A65B24D43ED7A08716B6AB1E04A86F14F9E763B44AE68AE88353ABB8988CA67D7E
Malicious:	false
Preview:	.}..8.%..n..fy[.....\'iR...6..}...Y....t....sd.:,L....?2..T.F.-.1.6.".?.>.....<.P.a.c.k.a.g.e. .P.r.o.d.u.c.t.C.o.d.e.=.".{.9.0.1.6.0.0.0.0.-.0.0.0.F.-.0.0.0.0.-.1.0.0.0.-.0.0.0.0.0.0.0.....6...?n..dy......\.iS.a.y..}...Y...$...ds..o,r...\?\|..s.h.C.o.m.p.o.n.e.n.t.L.i.s.t.>.........<.P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t. .P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t.I.d.=.".{.5.8.1.2.C..t.6.p.On...y.......\.i..Q.Q.}..Y....\..YsA.j,....?S..". .Q.u.a.l.i.f.i.e.r.=.".p.o.w.e.r.p.n.t...e.x.e.". .C.o.m.p.o.n.e.n.t.I.d.=.".{.E.0.A.7.6.4.9.2.-.0.F.D.5.-.4.E.C.2.-.8.5.7.0....B.l.8n...y........\piA.1.4.}..Y.....{..Ls".s,d..._?d..r.e.=.".P.P.T.F.i.l.e.s.". .K.e.y.F.i.l.e.=.".%.S.F.T._.P.R.O.G.R.A.M._.F.I.L.E.S._.X.6.4.%.\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\...%.a.4..n..wy......\.in.C.Z.}...Y....$..AsP.&,@...W?c..C.o.m.p.o.n.e.n.t.>.......<./.P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t.L.i.s.t.>.......<.C.u.s.t.o.m.E.x.t.e.n.s.i.o.n.L.i.s.t.>............r....n..+yh.....\;iU.\|.z..}..Y..

C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.en-us.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	29342
Entropy (8bit):	5.61617343005066
Encrypted:	false
SSDEEP:	384:L/hoflqXEAAj3cz+jCnZKhrWz7Aq9GQngEFTGvKqQ90A:LhoflqXU0hMWHAfdEFTEOaA
MD5:	2C180F095F87578A89B7CBDF3E6CAB8A
SHA1:	2F36B7228CA35C172DEF2B3D3BA48EEF03828312
SHA-256:	9FA55C92166A040DABC8323C42FBBD89855858B0F816C941E6B1F6DD08384282
SHA-512:	625D2B089D0A467A804F1802316E0D5F3E2F605193212842355320EDF3E8DC7A87C0AC3B354840D5B968C8D88487D9890B9AAEBF8B6CDABB14D02BF07CFDB544
Malicious:	false
Preview:	..U..WU..NK9......\|.FZ];..........n;........\|[#vZM.7.\|@C..9G!T.F.-.1.6.".?.>.....<.P.a.c.k.a.g.e. .P.r.o.d.u.c.t.C.o.d.e.=.".{.9.0.1.6.0.0.0.0.-.0.0.1.F.-.0.4.0.9.-.1.0.0.0.-.0.0.0.0.0.0.0.(./..Wn..NZ9......\|.FG]2....[....ns.........[Fv7M....~@..W9w!n.c.e.d.D.a.t.a.>.........<.F.e.a.t.u.r.e.L.i.s.t.>...........<.F.e.a.t.u.r.e. .F.e.a.t.u.r.e.I.d.=.".F.i.n.d.A.l.l.W.o.r.d.F.o......Wk..NK9.....\|.F.]g.[...f....nn...\....=[rv3M..P..@w.+9.!C.o.m.p.o.n.e.n.t. .C.o.m.p.o.n.e.n.t.I.d.=.".{.7.F.2.E.4.B.2.1.-.8.F.0.C.-.4.F.C.D.-.9.B.B.0.-.9.A.A.4.5.E.A.F.9.F.F.8.}.".>.<.A.*..W@..NH9.....\|.F>]^.p...?....nM...I....m[)v.M..S..@w.+9.!F.e.a.t.u.r.e. .F.e.a.t.u.r.e.I.d.=.".G.i.m.m.e._.O.n.D.e.m.a.n.d.D.a.t.a.". .P.a.r.e.n.t.=.".".>.............<.C.o.m.p.o.n.e.n...I..WB..NW9.....\|.Fz]0.D...M....n:......../[av.M..h.]@S..9&!0.9.-.1.0.0.0.-.0.E.3.2.E.9.F.6.E.5.5.8.}.".>.<./.C.o.m.p.o.n.e.n.t.>...........<./.F.e.a.t.u.r.e.>...........<.F.e.a.t.u.r.e. .(....WY..NU9.....\|.F{]-....S....n....

C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	24792
Entropy (8bit):	5.645615041565457
Encrypted:	false
SSDEEP:	384:6/ZYD7zlDX1rQ4HDSzj/IypzS5yI0eKGFfVVD9jRDTF7fqG:UoJlrQ4jSP/IR5yI0MfVZnTVfqG
MD5:	0F6E89072CE22D9198B7156B48B4F608
SHA1:	9626CEEB294C6236FA0D2D3FFFE09392921EB7C6
SHA-256:	2E96E3EFC87B142BC1C8656130E54B74D61641ED3FA57C39DC4F2934F227972C
SHA-512:	9D8C292C4B54CC7D02F95F2CFA9733115F4CB369898CADFB54E1ED4205AADDAEF9173FE3D628B35CA80644FF679545F2BCC80EB3E82D0CF7C94D29C18384391B
Malicious:	false
Preview:	S........nAN...1Q1...........K.....$..:.......9........:{.y..T.F.-.1.6.".?.>.....<.P.a.c.k.a.g.e. .P.r.o.d.u.c.t.C.o.d.e.=.".{.9.0.1.6.0.0.0.0.-.0.0.1.F.-.0.C.0.A.-.1.0.0.0.-.0.0.0.0.0.0.0..Wa..8.)..AL....Q/...........K.....$k..........9.....,.v{.y8.n.c.e.d.D.a.t.a.>.........<.F.e.a.t.u.r.e.L.i.s.t.>...........<.F.e.a.t.u.r.e. .F.e.a.t.u.r.e.I.d.=.".F.i.n.d.A.l.l.W.o.r.d.F.o..WJ...=...nA.....Qp...O......KL....$3.n........9.....@..{.ya.C.o.m.p.o.n.e.n.t. .C.o.m.p.o.n.e.n.t.I.d.=.".{.8.5.4.3.B.C.3.D.-.2.E.A.6.-.4.E.3.B.-.9.3.4.B.-.3.D.3.2.1.4.6.0.A.E.3.6.}.".>.<..Wd.......mA...:Q7....w.....K.....$8.{.......9.....@..{.ya.F.e.a.t.u.r.e. .F.e.a.t.u.r.e.I.d.=.".G.i.m.m.e._.O.n.D.e.m.a.n.d.D.a.t.a.". .P.a.r.e.n.t.=.".".>.............<.C.o.m.p.o.n.e.n..W........rA...1Q-..........K....$k.........9.......{.y..0.A.-.1.0.0.0.-.0.E.3.2.E.9.F.6.E.5.5.8.}.".>.<./.C.o.m.p.o.n.e.n.t.>...........<./.F.e.a.t.u.r.e.>...........<.F.e.a.t.u.r.e. ..WB.......pA...0Q~.........KC....$4.

C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	24792
Entropy (8bit):	5.5608080580190675
Encrypted:	false
SSDEEP:	384:TR/Fhl/c9rJ+YUYva4MhWlop3To+PCJNd:TZ3l/eJnUU5opDLUd
MD5:	F000D8694CD75BE935067D4ED9FB399A
SHA1:	CBE8625639D03EDC481ADC1D61AE6B317579F35B
SHA-256:	DB46BF31E6E9F13F09BDEE946529A61B14F67A30189E3C76BA2F4FA3CFFA0B06
SHA-512:	5542898C73360A20B31C12B3275D5865577F274CA06BFEF99E99625322373E24D664E96A6F28D6F7AA17186FF5BFDC8C6995CC441B91890C91C364C3318F85EC
Malicious:	false
Preview:	...wE.I.0.M1.....a.A..)eD.55o.:vA....w.fC.A......$..\|:..&RTT.F.-.1.6.".?.>.....<.P.a.c.k.a.g.e. .P.r.o.d.u.c.t.C.o.d.e.=.".{.9.0.1.6.0.0.0.0.-.0.0.1.F.-.0.4.0.C.-.1.0.0.0.-.0.0.0.0.0.0.0..P.wK.r...\1.....a.A..)#eE.z5eo.:zA\...w.f../......$..~:..D&bTn.c.e.d.D.a.t.a.>.........<.F.e.a.t.u.r.e.L.i.s.t.>...........<.F.e.a.t.u.r.e. .F.e.a.t.u.r.e.I.d.=.".F.i.n.d.A.l.l.W.o.r.d.F.o..P.w..w.4.M1F....a.A...)se..(5Xo.:AA...w.f....K....$...:.8&;TC.o.m.p.o.n.e.n.t. .C.o.m.p.o.n.e.n.t.I.d.=.".{.6.0.1.A.3.5.9.7.-.F.6.C.E.-.4.8.0.6.-.B.D.2.3.-.0.9.C.E.8.F.C.C.A.7.5.4.}.".>.<..P.w..\.-.N1M....a.A...)Oe#..5.o.:wAb...w.fX.P......$...:.8&;TF.e.a.t.u.r.e. .F.e.a.t.u.r.e.I.d.=.".G.i.m.m.e._.O.n.D.e.m.a.n.d.D.a.t.a.". .P.a.r.e.n.t.=.".".>.............<.C.o.m.p.o.n.e.n..P.w9.^.0.Q1L....a.A..)!e..5so.:hA....w.f....X....$..]:..&3T0.C.-.1.0.0.0.-.0.E.3.2.E.9.F.6.E.5.5.8.}.".>.<./.C.o.m.p.o.n.e.n.t.>...........<./.F.e.a.t.u.r.e.>...........<.F.e.a.t.u.r.e. ..P.w..E.(.S1F....a.A..)<eZ.`5mo.:9AP...

C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	102382
Entropy (8bit):	5.57166729172829
Encrypted:	false
SSDEEP:	1536:w9WUCgMleLTr45GDZ67JARyKjgH+VOM9F3r:wWLleLXMv2UDeVOM9F3r
MD5:	D6EE15F64C40EC07B0F3B41E866939C9
SHA1:	F445809D5886956F9EBE1A767FF3FD601530E1DA
SHA-256:	B260A02FA64003DE31B6BFD7F9AA8C56AEB5B23E794376CCAC52532660388894
SHA-512:	C9864F6AD1C01B7DB33C298944B093007FB371B49BF9552E0ABD60D7E7B095C2D85D733CAFC7BACBF93BCCDA7543DEB31D6C89EF88C232B8BE8A7ED8DF0CCF12
Malicious:	false
Preview:	9.l.q.&.n......N........R..R...#. .C..O9.P].{.4Z?).,m..h4mXJbT.F.-.1.6.".?.>.....<.P.a.c.k.a.g.e. .P.r.o.d.u.c.t.C.o.d.e.=.".{.9.0.1.6.0.0.0.0.-.0.0.0.F.-.0.0.0.0.-.1.0.0.0.-.0.0.0.0.0.0.0.........F.n....N........[..R....../.h.W..O~..].{.47?\|..m..74#Xvbs.h.C.o.m.p.o.n.e.n.t.L.i.s.t.>.........<.P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t. .P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t.I.d.=.".{.5.8.1.2.C...g...s.6. ...N......D....R......L.=.Q..Oh.x].{.4.?y.vm..b4.Xbb". .Q.u.a.l.i.f.i.e.r.=.".w.o.r.d.v.i.s.i...t.t.f.". .C.o.m.p.o.n.e.n.t.I.d.=.".{.6.C.A.1.B.0.9.6.-.A.0.8.2.-.4.C.8.3.-.9.B.C.0...b...g.;.%....N....4.~..R....}.`.%..O(._].{.4.?`..m..44;Xjbr.e.=.".W.O.R.D.S.h.a.r.e.d.F.i.l.e.s.". .K.e.y.F.i.l.e.=.".%.S.F.T._.P.R.O.G.R.A.M._.F.I.L.E.S._.X.6.4.%.\.M.i.c.r.o.s.o.f.t. ...6.(.7.`.v....N........X..R.....b.b....O5.M].{.4J?4.$m..k4sX0bP.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t.>.........<.P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t. .P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t.I.d.=.".{.5.8.1.2...e.y.o...&....N....F....R.....K.Q.L.

C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	40044
Entropy (8bit):	5.5938654936455166
Encrypted:	false
SSDEEP:	768:1/xpx0g8/WS7X1qIgs/5H+OnpUIRC3PJ7jgK:LrF8+gFqI7ReOn+mU9sK
MD5:	EAC9B10EEFF3E18516E6744B130C87B2
SHA1:	782F08B5658F806A101C3C6F8F93E9310001BC4A
SHA-256:	FD000E713702F85A4F136236E173A12D5C5C359FFCAD699A3678FFEFCD571343
SHA-512:	4D306115EFA465A772DC883BB2628CC70065FAE2BAF4D8FD0AE344344FEC9E2CBA2835F944083E02680740A0522E09BB2843F9C305F5CF95FA9C6968663E627A
Malicious:	false
Preview:	......x.f#`.<g.J.... ..x%a..k...=.Z6.h.......i..(...R.T.F.-.1.6.".?.>.....<.P.a.c.k.a.g.e. .P.r.o.d.u.c.t.C.o.d.e.=.".{.9.0.1.6.0.0.0.0.-.0.0.1.6.-.0.4.0.9.-.1.0.0.0.-.0.0.0.0.0.0.0.VY\|....x.f2`.<1...... ..y%..Fk..\=.Z"./.........<...(O.x.A.i.l.e.L.i.s.t.>.........<.H.e.l.p.F.i.l.e. .N.a.m.e.=.".E.X.C.E.L...H.X.S.". .P.a.t.h.=.".%.S.F.T._.P.R.O.G.R.A.M._.F.I.L.E.S._.HY....x.f.`.<r.].... ..b%\|.dk...M=.Zs.Q......r.c...(..T.6.0.3.3.\.". .N.a.m.e.s.p.a.c.e.N.a.m.e.=.".M.S...E.X.C.E.L...1.6...1.0.3.3.". .N.a.m.e.s.p.a.c.e.I.D.=.".E.X.C.E.L.". .L.c.i.d.=.2Y....x.fm`.<-...... ..P%5.Gk....)=.Z..1.......w.p...(O.m.K.i.s.t.>.......<.H.e.l.p.N.a.m.e.s.p.a.c.e.L.i.s.t.>.........<.H.e.l.p.N.a.m.e.s.p.a.c.e. .N.a.m.e.=.".E.X.C.E.L._.C.O.L...H.X.C.2Y.....x.f'`.<3...'.. ..F%..dk...e=.ZI.K.......H._...(..-.[.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.O.f.f.i.c.e.1.6.\.1.0.3.3.\.". .N.a.m.e.s.p.a.c.e.N.a.m.e.=.".M.S...E.X.C.E.L...1.6...1.0.3.3.2Y.....x.f`.<a.N.... ..e%?.Yk...P=.Z

C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	17288
Entropy (8bit):	5.632091973181417
Encrypted:	false
SSDEEP:	384:MlSohLXcgjbwnJrhZ84KUE/aX4g9Snsf0:MRQJlZ84K/ac
MD5:	05F4E9BB35921A7A780CCF4A363CA23E
SHA1:	A548105A346FE0947BEC0519B4F0C35570436D3E
SHA-256:	6B6500025A9C66D82888F3591CC4B08CCA6907853034B1BE6189CC0299BB47AA
SHA-512:	7BA42426A85742BA9BBCEA3AD85526BACB18F885B8BDF552FCF3CAA585AA1235221F19CCE8A8EBCEC9DEBFECB3D185234960925E7B069199E757646F4EBFC267
Malicious:	false
Preview:	...@...5.D.Y...W\|X?..<..j....e.o...h;.~h0.E.y......x-.xA.X=vX..T.F.-.1.6.".?.>.....<.P.a.c.k.a.g.e. .P.r.o.d.u.c.t.C.o.d.e.=.".{.9.0.1.6.0.0.0.0.-.0.0.C.1.-.0.4.0.9.-.1.0.0.0.-.0.0.0.0.0.0.0.t..@...5.D.Y....b\|F?..!..j....*.c... ;.~\|0CE[y..o..--.xC..=!X'.n.c.e.d.D.a.t.a.>.........<.F.e.a.t.u.r.e.L.i.s.t.>...........<.F.e.a.t.u.r.e. .F.e.a.t.u.r.e.I.d.=.".G.i.m.m.e._.O.n.D.e.m.a.n.V..@...5.D.Y...S\|X?..;..j....e.`...R;.~A0hEly..&...\|-.xI..=1X,.t. .C.o.m.p.o.n.e.n.t.I.d.=.".{.9.0.1.6.0.0.0.0.-.0.0.C.1.-.0.4.0.9.-.1.0.0.0.-.0.E.3.2.E.9.F.6.E.5.5.8.}.".>.<./.C.o.m.p.o.n.e.\..@...5.D.Y.....\|.?..0..j....5.;...U;.~A0hEly..#...p-.xS..=1Xb.F.e.a.t.u.r.e.I.d.=.".G.r.o.o.v.e.F.i.l.e.s.3.2.I.n.t.l._.1.0.3.3.". .P.a.r.e.n.t.=.".".>.............<.C.o.m.p.o.n.e.n.t. .C.o._..@...5.D.Y...V\|.?.... j......l....;.~e0QEPy..R...%-.x..P=yXz.8.1.3.-.E.F.0.7.E.6.3.4.E.E.1.E.}.".>.<./.C.o.m.p.o.n.e.n.t.>...........<./.F.e.a.t.u.r.e.>...........<.F.e.a.t.u.r.e. .F.e.a.t.G..@...5.D.Y...K\|D?.....j....4.m....;.~

C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	348594
Entropy (8bit):	5.646406264170573
Encrypted:	false
SSDEEP:	6144:pvrcmrqkdn2yTYhvyUD12eQQB/HZjgwYI5/9OOP5xgurmEUzo+LS:pvqkdn2etEkmSYiurmPzo+O
MD5:	7D7A352EA5357890F3BC6DF427617829
SHA1:	4FAD175B70246AA2F189DFEE03CD581320FE04FE
SHA-256:	272EDD64E9EC740F53C82881CEB5A52AAA14937FD39FC7E2B7A65C6EAA83411A
SHA-512:	05F8B6ABFD447487C59CDD6C5B80D9C4B150FA44D22EDBDD7CE90B7B6C18D0D4FDA4B2763C5F109AE13C1279B847AE57CD9D06055FD7DC406513E0853C61F663
Malicious:	false
Preview:	..2....<Z...&.k.;@.8.,5xg.M...R...^.>................_%.p..KT.F.-.1.6.".?.>.....<.P.a.c.k.a.g.e. .P.r.o.d.u.c.t.C.o.d.e.=.".{.9.0.1.6.0.0.0.0.-.0.0.C.1.-.0.0.0.0.-.1.0.0.0.-.0.0.0.0.0.0.0.C.H....<r....&..^.%@.8.,<xf.....^....^.>..S..........._z.>..Ks.h.C.o.m.p.o.n.e.n.t.L.i.s.t.>.........<.P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t. .P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t.I.d.=.".{.5.8.1.2.C.0.9....<.....&..#.}@.8.,mx$.2..%...^.>..E.........._/....K". .Q.u.a.l.i.f.i.e.r.=.".C.s.i...d.l.l...x.8.6.". .C.o.m.p.o.n.e.n.t.I.d.=.".{.F.D.5.6.4.8.4.6.-.A.E.6.5.-.4.3.6.6.-.B.5.2.B.-.3.;.p..<q....&..L.z@.8.,'x+.P.......^.>..............._l.'..Ke.=.".P.r.o.d.u.c.t.F.i.l.e.s.3.2.". .K.e.y.F.i.l.e.=.".%.C.S.I.D.L._.P.R.O.G.R.A.M._.F.I.L.E.S._.C.O.M.M.O.N.%.\.M.i.c.r.o.s.o.c.z....<_..&.j..@.8.,.x@.3..R....^.>.............._7....Kb.l.i.s.h.C.o.m.p.o.n.e.n.t.>.........<.P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t. .P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t.I.d.=.".{.5.8.1.2.C.5.2.?....<....&..:.}@.8.,wxK.5.."...^.>

C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	132084
Entropy (8bit):	5.656794260076193
Encrypted:	false
SSDEEP:	3072:Pf1Bwcc83EJRvMkY8HrWb4Tkjylo3NYkj8oPTleWd1Zrjk6zrv5kHsvmvMkt:Pvwcc83EJRvMkY8HrWb4TkjyOdtTleWG
MD5:	08505740DBCB46FBFE4FAF64B34EFCAC
SHA1:	D3F25A179B7E15A80EA062D2402089CE940B305A
SHA-256:	884C72E99254DF24FF08BBB64FD1B145C2025E85F63F42BE0CCF950BC7C7869B
SHA-512:	DD086A590E1B18011EEB86FCB3C2C6140EF352F0B2E739BD7AEC0B9FE91D285B5884EC71B19CA7245F4B3D07D65D2B97E698C00ACFC197A6938D62974A89125F
Malicious:	false
Preview:	jH.x^j4%r&.=?z.-.Y.....y\|..@.LT..:..`....^...R...4[.....4...^T.F.-.1.6.".?.>.....<.P.a.c.k.a.g.e. .P.r.o.d.u.c.t.C.o.d.e.=.".{.9.0.1.6.0.0.0.0.-.0.0.6.E.-.0.4.0.9.-.1.0.0.0.-.0.0.0.0.0.0.0...xPj.%Z&.??,...G.....p\|.....T..6..`........<...Y[..+..I4...^i.l.e.L.i.s.t.>.........<.H.e.l.p.F.i.l.e. .N.a.m.e.=.".G.R.A.P.H...H.X.S.". .P.a.t.h.=.".%.S.F.T._.P.R.O.G.R.A.M._.F.I.L.E.S._...xUji%C&..t?o.:.D.....p\|..].!T..r..`....g...W...9[......4...^0.3.3.\.". .N.a.m.e.s.p.a.c.e.N.a.m.e.=.".M.S...G.R.A.P.H...1.6...1.0.3.3.". .N.a.m.e.s.p.a.c.e.I.D.=.".G.R.A.P.H.". .L.c.i.d.=....xQj.%,&..#?0.g.c.....f\|.....T....`....2...y...<[.%..I4...^N.a.m.e.=.".S.E.T.L.A.N.G...H.X.S.". .P.a.t.h.=.".%.S.F.T._.P.R.O.G.R.A.M._.F.I.L.E.S._.X.6.4.%.\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c...x.j%y&.~?i.y......&\|..N.2T..4..`....^...A...3[.-..H4...^".M.S...S.E.T.L.A.N.G...1.6...1.0.3.3.". .N.a.m.e.s.p.a.c.e.I.D.=.".S.E.T.L.A.N.G.". .L.c.i.d.=.".1.0.3.3.".>.<./.H.e.l.p.F.i.l..xljF%.&..2?D.-.G......\|...."T..g..`..

C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	2356
Entropy (8bit):	7.113920289613392
Encrypted:	false
SSDEEP:	48:5grhttekj3aXl0ClYn1GN6KBJiQFpvXoBfzI0Zcncxy:5grhtteFl0Cl5BAivXok0On/
MD5:	3F82C3A696F580B4A0769E7814D9C3CF
SHA1:	FBA36683DA18897143D836E5AB5C953899C73668
SHA-256:	F931EA7E3BEE7C7AFE2989C521A67AFD221382B7FD4C1B221414FF2BAE796ED7
SHA-512:	DDC6FB31169B1F85467104D64D9D211C64FCE603CC846F1E0B95C79E352706CE422021A8ADE23B1A18706018613D79C4A56A37A3F7EC32E384CE319F062EA7B4
Malicious:	false
Preview:	.."....!.j.."..wP........i).rr.u=Ci...A...&.z...\..O.L3t.t.X.....!.j..j....w.........).r9.e=1i...K....j...\....S3..[.'.....!.j..d....w.....V..{).rl.\|=Li......d......\..B.^3..f.X....!.j..t...wB.......&).r~.==Wi......C.....\.....3D.N.}.....!.j..5....w)...._....).r(.0=.i...F...=. ....\..{.g3..f.{.....!.j..t...wB.........).ra.g=&i...B.....Q...\.....3O.D.Z.....!.j.....wF....^..i).rQ.O=hi..&.....q...\.....3O.T.>.....!.j..:..wW....^..0).rl.t=Wi......d......\.._.^3....'.....!.j..y....w.....Z...}).ri.p=Yi......f.]...\.....3D.N.j.....!.j..]....we........9).rb.H=ki..&.....{...\.....3..f.{.....!.j......w.........%).r(.$=.i...K...(.}...\.....3r.C.q.....!.j.. ..w.....P..k).r=.7=.i.......k. ....\..{.g3(...].....!.j..1..w.........$).r9.+=.i.......2.'....\..B.^3....3.....!.j..d....w.....S..{).rl.u=Qi....i...\|.]....\....L3....1.....!.j..:..wW....i..B).r`.j='i...[...;.{....\..{.g3(...X.....!.j..1....wF........).r8.x=Ci

C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	18768
Entropy (8bit):	5.581673524997203
Encrypted:	false
SSDEEP:	384:reGNQ7Sl4jgWg7S3MYwGFxkMcqTjEl9vmXP/aj:reRjgWV3MSFarqkGXo
MD5:	6BFBE4869B711BD3D3A03555975669AA
SHA1:	A911BB5D832EA8240C868A5142EA1370225CB669
SHA-256:	1BCCAC93039167E426D2FDF7CFE5AE609A339C540E00D1E6AAB400A5C6094393
SHA-512:	8C4E8CF1587459120F78778DAF8F323A06C4ABA78617F88D5108A4FD0907C4CB192F0FBF34683AE140ED4D0E9BBC78D24AD64FFC44154932B3B100ED235C6C1D
Malicious:	false
Preview:	......c\|..e3A.=S}j.I,.J._}...fN..K.R7..@..5....2v......\|\.r...T.F.-.1.6.".?.>.....<.P.a.c.k.a.g.e. .P.r.o.d.u.c.t.C.o.d.e.=.".{.9.0.1.6.0.0.0.0.-.0.0.A.1.-.0.4.0.9.-.1.0.0.0.-.0.0.0.0.0.0.0.{......cT..e1A.=f}t.[,.J._\|.U.)N..G..7..T...e...n2....\|.. ...i.l.e.L.i.s.t.>.........<.H.e.l.p.F.i.l.e. .N.a.m.e.=.".O.N.E.N.O.T.E...H.X.S.". .P.a.t.h.=.".%.S.F.T._.P.R.O.G.R.A.M._.F.I.L.E.n...a..c%.VeOA.=_}{.H,.J._\|.A.0N..*..7....>..+2t.....\|..a...\.1.0.3.3.\.". .N.a.m.e.s.p.a.c.e.N.a.m.e.=.".M.S...O.N.E.N.O.T.E...1.6...1.0.3.3.". .N.a.m.e.s.p.a.c.e.I.D.=.".O.N.E.N.O.T.E.".....Z..cu.Ne1A.=.}+..,.J._/....ND....7....>...i2......\|).5...p.F.i.l.e.L.i.s.t.>.......<.H.e.l.p.N.a.m.e.s.p.a.c.e.L.i.s.t.>.........<.H.e.l.p.N.a.m.e.s.p.a.c.e. .N.a.m.e.=.".O.N.E.N.O.T.E.b...v..c?.;eKA.=.}8.j,.J._{...fN..6.$7..?......#2@....\|'.....E.S._.X.6.4.%.\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.O.f.f.i.c.e.1.6.\.1.0.3.3.\.". .N.a.m.e.s.p.a.c.e.N.a.m.e.=.".M.S...O.N.E.N.O.i......c'.]e"A.=.}+..,.J._r.J.!NR....7..

C:\Program Files\Microsoft Office\root\Integration\C2RManifest.outlookmui.msi.16.en-us.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	113230
Entropy (8bit):	5.61602094556737
Encrypted:	false
SSDEEP:	768:e1RtqsZEOBJ4zyqVEgoyAPoXbiK4hLBAP9TCylrFJKYhfpY/UJq/BJf8BEKhuCjP:UgrWh9yXlrFB7E/nf8geiu
MD5:	1BF7D26ECF7524DEFA0A20292AB1A25C
SHA1:	14CFFF77AAA5210D4EDA1C99223ECB2627CB0097
SHA-256:	C559ACC901EA72A91C6DB5EAEF95E9A2DD8324DF940052EC6EE78E643A930436
SHA-512:	C1C5375F59E3F4D852A12AE247650292FFF609F2B4DE0146BE42DCB61423848406F233BB5826D357D91620DBF77B13FFC5D2C98B52F0A6420FB11450F0186AE1
Malicious:	false
Preview:	.>rN..0.=.B...B.h.).IW".:=W....2....I.....F.2..f...^L.Y;~..T.F.-.1.6.".?.>.....<.P.a.c.k.a.g.e. .P.r.o.d.u.c.t.C.o.d.e.=.".{.9.0.1.6.0.0.0.0.-.0.0.1.A.-.0.4.0.9.-.1.0.0.0.-.0.0.0.0.0.0.0.'..N......S.....].7.[W?.3=V...2....]....ZF..W..f...^^..;0...s.h.C.o.m.p.o.n.e.n.t.L.i.s.t.>.........<.P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t. .P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t.I.d.=.".{.6.D.B.1.9.S..N..e.h.l..... .o..W{.c=.....2...........RF.....f...^..';e..". .Q.u.a.l.i.f.i.e.r.=.".1.0.3.3.\.9.5.". .C.o.m.p.o.n.e.n.t.I.d.=.".{.A.A.B.A.5.6.5.8.-.9.A.1.0.-.4.C.5.9.-.B.1.8.B.-.8.F.5.8.Q.zN..q.f.......p.y..W..%=I...2.....I...."F..<..f...^N.Y;~..u.t.l.o.o.k.M.A.P.I.2.I.n.t.l._.1.0.3.3.". .K.e.y.F.i.l.e.=.".%.S.F.T._.P.R.O.G.R.A.M._.F.I.L.E.S._.C.O.M.M.O.N._.X.6.4.%.\.S.Y.2..N......c...y.L...sW..d=.....2.....&....-F..o..f...^g.F;b./.P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t.>.........<.P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t. .P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t.I.d.=.".{.6.D.B.P.wN..y.......v.9.k..W..a=.....2....).

C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28478
Entropy (8bit):	5.623658740492339
Encrypted:	false
SSDEEP:	384:knuGOnbVn3bvosirOoLNxrnDVwrWGN1g2r0aUQyKxsO:qub3csirLNx7DVwrLg2VUQvd
MD5:	FD7FE33177924B217C8E26D772298039
SHA1:	F7C03665DC4F8AE1DA5FA1C474A0CD4AC8338BA7
SHA-256:	237376679A990E3D0C466F2974DACE921A44FA0CC44EAA017B6848E78C92EE1B
SHA-512:	B12C981E8474E47A1B2DEA9BC63FBB7B9421E9D3386472F97760489AD245A60ED39ECE9E978B9174D94BB66B40187324AE39A5C04DA0DF875D97FF989258C7BB
Malicious:	false
Preview:	G.4Y.Fo....._.i'F....F.U...vwl_..<}u.....wn.k.....V.N.1.i.../T.F.-.1.6.".?.>.....<.P.a.c.k.a.g.e. .P.r.o.d.u.c.t.C.o.d.e.=.".{.9.0.1.6.0.0.0.0.-.0.0.1.8.-.0.4.0.9.-.1.0.0.0.-.0.0.0.0.0.0.0..8NY.FT....._..\'X....F.U.N.9w`_..t}a....'n.k...QV.N.1Gi.../i.l.e.L.i.s.t.>.........<.H.e.l.p.F.i.l.e. .N.a.m.e.=.".P.O.W.E.R.P.N.T...H.X.S.". .P.a.t.h.=.".%.S.F.T._.P.R.O.G.R.A.M._.F.I.L..8[Y.FO....._.A']....F.U.S.2w)_..C}1.....zn.k.....V.N.1Hi.../6.\.1.0.3.3.\.". .N.a.m.e.s.p.a.c.e.N.a.m.e.=.".M.S...P.O.W.E.R.P.N.T...1.6...1.0.3.3.". .N.a.m.e.s.p.a.c.e.I.D.=.".P.O.W.E.R.P..8\Y.F7...._..1'....F.U....jwa_..D}2....._n.k....SV.N.1"i.../H.e.l.p.F.i.l.e.L.i.s.t.>.......<.H.e.l.p.N.a.m.e.s.p.a.c.e.L.i.s.t.>.........<.H.e.l.p.N.a.m.e.s.p.a.c.e. .N.a.m.e.=.".P.O.W.E..8XY.FC...._."'\|....F.U..l.5w)_..1}u....._n.k....?V.N.1yi.../_.F.I.L.E.S._.X.6.4.%.\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.O.f.f.i.c.e.1.6.\.1.0.3.3.\.". .N.a.m.e.s.p.a.c.e.N.a.m.e.=.".M.S...P..8_Y.FE...._..='....F.U....vw}_..m}:.

C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	2356
Entropy (8bit):	7.079062558063654
Encrypted:	false
SSDEEP:	48:0ryNXkN7OBNmHCyKGU1yKWk8VHGWwWtE6Z0EeeBkxiZc3:dNa7Ormi79PEHvmEee7O3
MD5:	50CD45F4E5689D8C1E883521E2495797
SHA1:	E8EDAFA5B2D8D58B310AD5311CBE66A6C521B2F1
SHA-256:	C8A7E928241CA473EA36D5D31B2B26B73A7E9DF0F3F95839AF57BFC72ED54305
SHA-512:	4428FD00E15DE3B837224AF5AECCD324E3CD0CD0286B5041F7FCBEFA2D914DAB70067088A22D88FFE3B9FDA2CE13686B0B17269A8B76339B35439A9F4E6BF584
Malicious:	false
Preview:	.....p...........UG.a...(8.c..x.j...._.a.......E.d.O(.<.....5.....p...........G.a...(n. .Yx.j......k.......E.d.O+.d.....5.....p...........G.a..((.q..x.j....N.4......E.d_O..1.....5....p.........GG.a...(w.,..x.j....K.&......E.d<O.p.R...5.F.p...........,G.a..(C.$._x.j......H......E.deOF.......5.B.p.........GG.a...(`...Zx.j......i.......E.d+O.l.F...5.B.p...........CG.a...('.c..x.j....v........E.d.O .o.B...5..`.p...........RG.a...('.:..x.j....O.4......E.d]O..,.....5.....p...........G.a...(C.w.{x.j......&.......E.d.O?.n.I...5....p.........`G.a...(p.3.[x.j....v........E.d.O:.s.B...5.B.p............G.a...(L./.Mx.j......a.......E.d.O(.d.T...5.S.p..........G.a.('.a.nx.j......p......E.deOF........5.L.p..........G.a...(u...Px.j....6.`.....E.d^Oy.1.....5.....p...........G.a.(5.q..x.j....>.A........E.dXO..\|.....5..`.p...........RG.a..(..H.7x.j......e.......E.dbOE........5..F.p...........CG.a...(w.$.wx.j....

C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	839176
Entropy (8bit):	5.608384129146501
Encrypted:	false
SSDEEP:	6144:kcaPaD+K6NCh3wcVPKk5LFf7KNxQ18EObhAdm1:faPFKJ5LFf7utUm1
MD5:	25F9BA1D916C71C2C5650B11417EEDBD
SHA1:	AFA90FC41E655D9FBA9C3CA97350272D7371B21E
SHA-256:	D42C149F960E4D85B482852A1B8415D9D1F291A0A90420B166ED477903980091
SHA-512:	54B7D861C36E1B011E2A5398F62909A16BEF03482B8081C4123F9D4AB9698917516736EB57A9DA93334B3C60241BB094B40044CADB5DA127CC23ECDE82D1C44A
Malicious:	false
Preview:	..J+^...K..sB.....}.Ci...F_..k...\|...tl..)..'..;...~t...)...2..T.F.-.1.6.".?.>.....<.P.a.c.k.a.g.e. .P.r.o.d.u.c.t.C.o.d.e.=.".{.9.0.1.6.0.0.0.0.-.0.0.0.F.-.0.0.0.0.-.1.0.0.0.-.0.0.0.0.0.0.0.X.0+P...K..qB.....}.Ct...G_S.$...p...`l..n.O'.^..+t<..) ..2..s.h.C.o.m.p.o.n.e.n.t.L.i.s.t.>.........<.P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t. .P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t.I.d.=.".{.5.8.1.2.C.+.A+P...K...B....}.C6...._c...f.....flx.x.7'.c....tX..)u..2..". .Q.u.a.l.i.f.i.e.r.=.".C.s.i...d.l.l...x.6.4.". .C.o.m.p.o.n.e.n.t.I.d.=.".{.F.5.2.B.0.E.C.8.-.8.A.9.A.-.4.9.B.6.-.9.7.2.3.-.\.E+V..K...B....}.C7...._....P."...7lM.-.L'.v..Qt...)6..2..e.=.".P.r.o.d.u.c.t.F.i.l.e.s.". .K.e.y.F.i.l.e.=.".%.S.F.T._.P.R.O.G.R.A.M._.F.I.L.E.S._.C.O.M.M.O.N._.X.6.4.%.\.M.i.c.r.o.s.o.x..+A...K..!B...}.CF...a_b.....d....lJ.%._'..8...5tR..)m..2..b.l.i.s.h.C.o.m.p.o.n.e.n.t.>.........<.P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t. .P.u.b.l.i.s.h.C.o.m.p.o.n.e.n.t.I.d.=.".{.5.8.1.2.C.5.).G+L...K..cB....}.C7...j_d...a......l

C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	81110
Entropy (8bit):	5.572591710940762
Encrypted:	false
SSDEEP:	768:QGLo2YSHlgG5tQsN+sEOjGsjXohO2k0W0nFxbSuY/HlJ4PMgvkrgS:QPoFx5tesJjGsboA7yP6lJ4PMZ
MD5:	BFAEEE9EB2B3D47E72A845C2D663BEAA
SHA1:	D47A4982AB4B0E6EB0F1806559A5A10795DED317
SHA-256:	EC188BDF5C0663FEFC629E7E9A777078C2B7A7328B49305C5F95CC426B6D1C14
SHA-512:	AC29E242C7B9E084962EFD6FF197A77561D50B84DFD8A3A2BE6A4BF00CD45A5BD2FBBB172A648CF7D0AE3ECE83309BAA58BE23B076398BB64B25251710E0ECB6
Malicious:	false
Preview:	.....h.r9t.....t.'{.A\|.E.'...yg.P...k.....-8M".W^Ww...\....%[r,.T.F.-.1.6.".?.>.....<.P.a.c.k.a.g.e. .P.r.o.d.u.c.t.C.o.d.e.=.".{.9.0.1.6.0.0.0.0.-.0.0.1.B.-.0.4.0.9.-.1.0.0.0.-.0.0.0.0.0.0.0..f...h.r.t.....t.'e.S\|.E.'..y(.\...#.....j8.".W;W...z...%.r?.i.l.e.L.i.s.t.>.........<.H.e.l.p.F.i.l.e. .N.a.m.e.=.".W.I.N.W.O.R.D...H.X.S.". .P.a.t.h.=.".%.S.F.T._.P.R.O.G.R.A.M._.F.I.L.E..f...h.r`t.....t.'j.@\|.E.'..y1.A...=...B.+8F".W~Wu...[...%HrO.\.1.0.3.3.\.". .N.a.m.e.s.p.a.c.e.N.a.m.e.=.".M.S...W.I.N.W.O.R.D...1.6...1.0.3.3.". .N.a.m.e.s.p.a.c.e.I.D.=.".W.I.N.W.O.R.D.".qf...h.r0t.....t.':..\|.E.'...y......+...B.$8F".W<W........%.r..p.F.i.l.e.L.i.s.t.>.......<.H.e.l.p.N.a.m.e.s.p.a.c.e.L.i.s.t.>.........<.H.e.l.p.N.a.m.e.s.p.a.c.e. .N.a.m.e.=.".W.I.N.W.O.R.D..f...h.rzt.....t.').b\|.E.'...yg.D.......t..8q".WvWA........%0r5.E.S._.X.6.4.%.\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.O.f.f.i.c.e.1.6.\.1.0.3.3.\.". .N.a.m.e.s.p.a.c.e.N.a.m.e.=.".M.S...W.I.N.W.O..f...h.rbt.....t.':..\|.E.'..y .....:...

C:\Program Files\Microsoft Office\root\Integration\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25849
Entropy (8bit):	6.6477217229433725
Encrypted:	false
SSDEEP:	384:stP1EzeS9VkWRo1yoM3603IT1dz6Ui+e95Vudean4u6orTWHCTJdovnyymDFKaLi:a6/D3A1dPgbkgmbu
MD5:	26D76E03D308B66F41EF899C40423A32
SHA1:	5DFF44FAC14460DBE31D4B3E9815B3A9DC51DA47
SHA-256:	56453481BE704422B51398AC979FDF99BAED27F8C1BE445BE69C1CA19BED8BEC
SHA-512:	58DBBD2B3DC15B93A9ACF279E6FEC2E786B5D0D7B829D23F0A0E82E8B0A2593167EFFD74C4B1629AC4A79273B6EA36E6D0023A92855C8C7DE2A5AB7A96BF1B62
Malicious:	false
Preview:	h83.\|...P.....w..x..?:X...g../_.%.%..n.. ..N.v..n'.M'!UxW.{.h.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{40845a59-a735-c7e2-2004-6c5bb506a149}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x...Jy...R.....h...$V..-n....=.#P...%o.\|y.p..J.}.xk..#;R2..v.m..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office195CBC52-71CC-4909-A7A3-90D74...w... .....{..,...%+_...0..(..0.\|.."[.3..n.-..g=.U"+.9.Z?.y.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X....l.........\|..&H..?'[...3..f..k.'U.&..;..H.\|..%d.Md.t..d+.VT/TM/v2" value="Office19Access2019R_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www...Z1.........7...f~..Sm...x.,A.=.xP.>E.&.Y..#..xk.P9&I0LH .&.l:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC....v..F....0:...fU..o0Z...G..,A.=.xM.8

C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11933
Entropy (8bit):	7.056509569304319
Encrypted:	false
SSDEEP:	192:rw+S+k2phFznnKsNt4c9JISjM80XgTbiKGP5rAis:VSE5jNR9yzCGPKis
MD5:	F5B881606BA802DEC10C0D873CFDD4BB
SHA1:	13248944DEB16877ADD788B129E3ED63DA1E0873
SHA-256:	D12620A29E8E164AF6DB42A04BA02E99DA395ABC11D7E75FA607324D74D1AE1C
SHA-512:	9427A1510F13819532CB51F015EF3ECD100FF2CBD3CA8476A9D64BFE618CD2088B7159FA91BFC61C9EE690C9721D21D4BCB1787D53ABBB86F7230EC8DF00B5D7
Malicious:	false
Preview:	....t..by...(W....z.@..VN.....}%.X...\|.W...{..B..+j.<H...>..Yrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{0b5ddd1c-bb3a-40d1-aa36-.<^Y.iH.$j..c...SH'..Z'.X.....%`.A.O.l.YW.-........dvy..*...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..q..~<.p ...7....Tn..Vv].-....%'..D..~...G..t..T..f}.%QI..}...itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Access2019R_Grace"]</r:a..QT.t..'\|.../...M.2..cvT.^....2F.@D\.,.....v..N..p...9JE.. .3ossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200.u...t..&\|...c..lg...t{TX.U...$r.Y.......?..@..I....0.P.....kdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI.n...~C.%@....k..zk..ZzYz}.1...>.H.^.4.

C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10971
Entropy (8bit):	7.01018523905794
Encrypted:	false
SSDEEP:	192:ezhGvm0bIhgw/Ip0c4SS4rfO++ZhaVxW/c9:eUtbjwwpL4SS4C++Pil9
MD5:	8C353C32F6277B7DF2944CD70A98FE03
SHA1:	A1D1DCE02E10A0EA1BB342AFE80744137A015477
SHA-256:	2C7A1591A6CD994978F0FB8A368A2316ADB366205E4A037C6DF0D5D9980D1A08
SHA-512:	4E44CBEBA523E1C6374D885C5B8FBAC8F576D40A6440917C62D3FC7EF78AF2BDBD18F69B1DAC9A2A2AD2AC99E1A86E54603B92FB6EF53A6FC5764169C807A8C4
Malicious:	false
Preview:	....?yj.7...{O..{n.i..-z.wi....7.....w... 08..._....3c.Ox.(....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{060fda68-63a1-4b21-8e99-l.H.ae0.s...u...+ .4..u".at.S..o@Gf8.(...bg1B....%...T.q.Ze...Es:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..5.XsJ.%...'P..xp.}L.ys.I....o.L2h.:_I..:>l..S#...$,.o-.)..../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll +...alb.5...lO..dr.hJ.kp.Uj.W..0L.r..#Y@..n%8...U~\..8Z.S-.e...Es="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b;.L.fR?.'..XR..i.....lk._h....Xi.n&.w.\|..k.gO..B....%n..7..0.zPKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4..:.kKa.A...j....:.h..5o.B`...@y.7:..?..

C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25854
Entropy (8bit):	6.610841094007105
Encrypted:	false
SSDEEP:	384:YI7hUf6DmG3Nr/CbwJ6ke5k+3vpYXmezv5TufoF7VGjgI6I33WnCJ6jA3/5BK/RN:HJFEkSil9FBGqIcF6/0N
MD5:	14A6E52869212759D54651E926FE1728
SHA1:	25396BFA3317C177C91D2064A15C6D9C3E4AC96F
SHA-256:	411074FBA11BE39F758E72178F3B23813C67667EFEBCEAAA0262437743A9C9CC
SHA-512:	727DCB3274CC7536DF1C45E4A7548E7E0FA1574B62426E40994CD87852B58BB77AADF82D66D27DB20BB4F0CE2138329D3150CF9DE55BDC354FC1D399525F8372
Malicious:	false
Preview:	....D2....C..+.D=X.`.G~c....QR.........E.Yw>..jg.sc...CP9R.:.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b2eaad67-1ab4-c272-0620-ea1d4210ec4f}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x=:r..Q'@..._..4..%...%..2....^..U...m....Ms1..#q.6,.....+_.?..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office71BA37DB-38DE-4F2A-B290-1D031../....].(....'..l...0.Vyt...DU..wY..3..V.EW9.jn.l{.....b.S+.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X".P..h.R.J.... ..v...&.Z}l...^....6.E.7.^.Gq...m,.dcM..4.\./../TM/v2" value="Office19Access2019R_OEM_Perp"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://'!k.U<....W..'..0-..m.P]L........%^^.0..X.\j$.)2.$}....Kk..<.><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-.._...iH.L...v.;=W..m.Np....O&...%^^.0

C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11926
Entropy (8bit):	7.079431959886424
Encrypted:	false
SSDEEP:	192:8FF9ov2glr6OASI+EWarVv8aTpaZeSPmOBvjtOr+ogdGUJEgC:YFi9ghCaJv8al6eOBLta+ogdJEgC
MD5:	64A81104CC7682BBF0F8D4596FE0E559
SHA1:	7EA36AC6CB3618DCDA44E6E1270EC5F1DA13C9B8
SHA-256:	A3E5927D51D430206143E825DBFA7CC3842AD7ED229B9457F2869CA088F3137D
SHA-512:	3F337326271C2ACBE987F5B552DA281E6CAA0ED466ADEF572B16555908AB22FEB9E1ED92563842236FA0947EC0CA73D07B5A9557B87D3B1388C28C2062FD938E
Malicious:	false
Preview:	..%.h._}I....Oz.q.D....83.!..).5.izw...{.,..%..n!...wH.....yrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{cc3c95a4-4c7b-494a-a8c6-X...1..r......5.![.^..K.t%.+...q.z..2(...u..%M.w..GK..I;....-s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.......][...P'.r.....G.3n #..q.q./.....%.....(...#6..n.....V7itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Access2019R_OEM_Perp"]</I.....^T....U\|.".I...U.$..)...../.N;#...5..{..d...b....uR.....1tyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/....x..>.....Or.n.I...x./..)..(./.z;:.....a/.%..eW...f!...G5.cYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZh...c..S....kv..dFk..q.n.,...'.o.6.+.

C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20270
Entropy (8bit):	7.2102682561388
Encrypted:	false
SSDEEP:	192:flaXJFOBrAGVOAKOGGyL9mVMmB3z/eo5JQ/GhXP1HHhTEmAQx8KyE7GUZM0e3z/4:flOqrYTGyLQn5UGhf1WmNhh7bZXeOAD4
MD5:	AE624E260486C686FC1CFD99CBE90F0B
SHA1:	A666EB3439A7A9C8168D3E004F00B9FE44AA97B7
SHA-256:	F197B41286588EC85DB3F94D7C8AB3E971E6255D306780C9625381B030947C70
SHA-512:	9F480576B881816AFCB69764DC037D13C4DFB8F90DE8B9BAA9898B59AEE2059FDF5D5007C99D08C30F4B42F407788A4E0B0DCA7CF061112AB186803C72F32219
Malicious:	false
Preview:	].0a4.;...)C.D..m..98h..-..n.=y...r{O.9#.q.%........3.k...Hmrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{24a40106-d9bb-4be0-aa8d-.,.dh.nV...bM...L#..3i0..;..m.e<....-kA.7a.x.\|\.......b1...W9s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.G.rS.."........s..}s<..p...i.e{.....y..j?.k.%.........!]z..%:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Access2019R_OEM_Perp"].:.gj......+B.X.H .55:..!..l.<).....5..s0...!.......}.a...T'ertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.or.:.m;.y^..6\.X.Fl..5H...+..l.ee....?5..;=.".;5.........r...AcYBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr.O..B.bW..ia.d.B...:\.......B.g....s .

C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10963
Entropy (8bit):	7.081857001484021
Encrypted:	false
SSDEEP:	96:Q7Bemm8Zg7cg3FaZYH7qY5TLwNA0MOy/KgRAOX3ysL1ZaD4T4ASdJNZ5EK2wdI7v:QgCaJCYH7x+yTXH7LYX5En7WANjJOON
MD5:	A40E677386C1CB0EB730AEA5F5699342
SHA1:	2E8159C2A14A3DB2F22CE090C777E3F15DF0F4CC
SHA-256:	724CD35998D7EE38FFB74B400B4934C8147FE491F14C30025EA7C64CBF3C8C79
SHA-512:	178E9CD00661E253255D8ED113AD1157A8DC4020B312BEF7DCDF7D738DD14686DDC9E40902D179361991428A4CD4570B4D63723E76485FC60D41AF06A5551D11
Malicious:	false
Preview:	..0]%......s.M.=2#.G_.Sh..* ..v...Vf.nC..4.-.].{....l./.rs.(rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{60277c2d-5d6c-404d-9426-."..+.......8.[]sm~.....~..y#.3O...9.`G..b...a.R.".DRyu.fp.\|s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/p..NB......l...#q7....X5/.%'.tD.++.=.....?...P.p...AL_5.w~../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll B!./{.....s.D.!?"._..OJ..}r..?....2.4....1.(...U....p_2.fp.\|s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bR..0\|;......n.m.QDA....i@..).......6f..<....o.y.p.y...Y$X..gP.CPKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4~!.Qq".....*.AgiT".?G.l]..7...g?.....~

C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25852
Entropy (8bit):	6.693846677984224
Encrypted:	false
SSDEEP:	384:n9gV6c4mBC82+6sYo9ohUPBO9S/+eQ5iukyHjHOVD6SuEWFJWbCCo63b7mpHKs6a:uxJYoGmwDDukynV3y6hY
MD5:	5529E26EDB12B6C57A1BA7005B3D18EA
SHA1:	978DF85BDE7C9875ADDAE06746F4F8121FB37D61
SHA-256:	C73150DCFB9540E770F3221E1015B99F38507EB54E1BEDEED8DC05AA2F22E5EE
SHA-512:	67E1563D76294B75DC91DAE69938C02AB62A0AB88C9577BEF9059BCEE5CE3F7237BA5D8BCAEAD79CD64D746E33AC1EB9857403D076B694D92909BDB801A0BEE2
Malicious:	false
Preview:	....._.div...P...~.&t8.Y..\|U.j.U....%.......D.g.f...8..p...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e2d3b4c6-cccd-900e-8383-79feae5cc246}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x/c...J.fja...O.P.".s1......(..e.d...7j.F....O....#L..r..}....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office518687BD-DC55-45B9-8FA6-F918Es?.......OW..\.Y..9$".Z...@./)@....iH......g.y....y..4..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X0B.....2-1...[.C. ._28...X..0Z.<+....m.....N.`..q...O.. .../TM/v2" value="Office19Access2019R_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://ww5!...].+yg..RSs...N$U...e..d..vgR...sK.....F..(..rT..m.&...sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BA.9......)#..P}^..s.e:"..._..[\.vgR...v

C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11918
Entropy (8bit):	7.075324439178887
Encrypted:	false
SSDEEP:	192:jKisiR820gUbOY2hwu+wk3CAW3jQfHJ6X1W+KsWkMHHx5du:jKuRgg3hpYCBh1KsWHHHU
MD5:	23A16E7E1C77086F6DADD4497E0B7683
SHA1:	3484473AB39751EBB7E43FEF343433E7B6A76B49
SHA-256:	8B43C16F7AC4A46B6CBD8F277A38ED7F7716BC6707210456704B88037EAEFADE
SHA-512:	C984DC3E5243757F6A8BD4E49BB93CA500723310B9038F31E85D259EB265B3D929CEDB4147DD36BB5DB06C1FF9592B292F8001A3F9B810AD06EA62DCD431B830
Malicious:	false
Preview:	..B<........F&..]J. ./..(.....e0M...2.@z...MqKq1.]..jJ. ...;l..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8863697a-970b-4eed-8622-K..c........Hm....}.~...>.....=u...Um.N~...D'.#y.k..K}..../o..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/j=./..#......9..^T.4.d...u.....=2..XeF..+....~G\|'...mG.9...xp.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Access2019R_Retail"]</r:O..m.'..^.\ ..\G.4.b...'.F..7`y...\|......J?Cb$.J..$W. ...2p..Possessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/20._.0.M..@.Rl..\:.O.h...'....7vM..C4.>-....~u]>....)D.)...@..lkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOg[.9. ..}.V...S..C.^.......wD...J~..

C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20262
Entropy (8bit):	7.252757298482611
Encrypted:	false
SSDEEP:	384:FeUIkmHyEO3WqSAlvbtYqRJnQhdHbWswz05:5OyE1AlvbtbRJnQh5W+5
MD5:	5AE779AD79B38CF984D3B8FA5913A806
SHA1:	0F97C7BA0E16570D5F7AE82D10CE58FE0DD10240
SHA-256:	80388BC86454C21521DC7B5A15CCF9622C5905AEB04B7568521E9235423257CD
SHA-512:	405F7A07683631E4C20B86ECDB93B283416E784399A81F220349B20CF6D110FB52B1833A7CFF22E34098FA70B4ED944F7B0B56D06649F4B5B4EB26C44F71F66A
Malicious:	false
Preview:	.0jj.AH._..2..>.q..w65..V.P.....h.\|...t...6...?A.Ti2...:wrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{0beead3b-d879-44c4-bd58-...d.......!.\q..?..&nm...\@S........x.x.Z.}T......}.v.j.h...%#s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/c.y.Kh(M...B.c..o...<b<...T.W.......j....n"..6..pe~.F%#...f?:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Access2019R_Retail"]</U..8.TI!...%..8..m...op?..^D........j.#.$.#...(..4o..Vs:...,?tyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/...f...K..$..6..m....]5..^.[......9.....96.....a?`.E.3....cYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZt.b...&...'"32.......T....pY......0.

C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11475
Entropy (8bit):	7.122163587074168
Encrypted:	false
SSDEEP:	192:mWSjai8/C2pIfsPThM3DYHEXuCmjAvK0dqSbTgrqkpCyHCg:mWSuiSPiTYHMuC5iXSbUrpFHt
MD5:	BB2C4D75033D3BB0D4D99D3C8DFD1DCA
SHA1:	CBB0725A94618112C141C5F832467FA00ECEF050
SHA-256:	E452ED523B99EA879C3EC8D8E94CFC304D15DCB5435FD1C5272EC673C561F9C6
SHA-512:	FE3306A966A72A3D6F1D60109DB41D2448E47B5DDDB79FE59296D97036052D746142BB6DAD2C8A25AD95821A47C84F3AB30623CC3176583097BDBD3D0377013A
Malicious:	false
Preview:	...C...j......6.m.}a....<T....W-...jn......R....[.H.u....j.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{815d17fe-2649-4f3e-8191-q..F...)...E..Bx.0.,9I...6.....4.C_z`......X.J....z........uEs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..iP.....3>.V....(.y[65...">[....`.vM=..H}....L... ....0./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll >.V1.....~.......l]e'....4....M+.JTh'..U.....H.X......pEgPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200x..F...o..ZE..}G..J&.....f....N,..M2.....1.H...[.Q.$....[ZrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV;.T.........?....?..Xf;3..$lL....rv.Gvx=

C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25901
Entropy (8bit):	6.664985368087771
Encrypted:	false
SSDEEP:	384:mgN7nE3JGbh6koN+Ot8HVG6Pc5MuuUfhnpEFYXKq+zsiwUC1iZ75WQi8CKQKuyCy:37nEoBw0TQhnyYYQiTCcZoQiRU
MD5:	A7A152B8B9B9A046C1ADA83EB152F94A
SHA1:	6E5282536286F807CECF8478F43B5E5EEE5ABF9B
SHA-256:	B1C08FAE5DD963387A4BEE6778BBEE8F28666942C88BA82FFC88D1FE9D2B9B49
SHA-512:	94DEB6C0BAFAD4B699AF83497C0574D47A955FA71AB1B8B69F1EB10740C0D8C2E843F17DC0FD325A255D1EAE08EB6D8A0072DE0DF9DD4243B374C8BBB3828FB6
Malicious:	false
Preview:	..:.9.r..!...C?.@..K/.c.G.v.T......Ep;7x.$...r.Q..C....=..:...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{0893de86-1ade-2725-ffde-4be7eb1fcedb}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x~b..<.g.."...G ....z.q...."N....;..E.A%..t...}.L.......w..7....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office35CB0CD2-0B1C-47CD-B365-6E85FP<.3.^..$..C3....Y0.y..P.wC........v%{*.7...u....Y.....\|.~..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/XaC.).R.eB..O4.....V.c..H.a@......G?n.h.?...b.Y.....E.J..j.../TM/v2" value="Office19Access2019R_Trial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www=c..t.l..#N..G../..=m....w.=.........:pg4.".B.!.........u..a...l:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC%#..3.+..gX..hr.L...s.3.M.k4T.......'ua

C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11930
Entropy (8bit):	6.983497349741559
Encrypted:	false
SSDEEP:	192:1bgVz7nYqCTQ7FX/QmLr2hH0py0SHgTUDyjG7XFSYcMjfi:1UV3nnCQhPA0jIfXFBDG
MD5:	AC05951890DD3FA4B6F0BBC41599AC88
SHA1:	404F01C2017D337602E3F20500668ECF279AEFE2
SHA-256:	CF0A5802224545439A42303FF8A94D467F294CFF71C1CE14E2D8DB2692B0978D
SHA-512:	13B7A26B5228802C0D2812657FD0D888C044633D058AEBADF792935C4731EBC456BCA40D60CCE21245A7A30D81F412200A1D564864330883911D1826D9B3BD1B
Malicious:	false
Preview:	3].j....}x).97....}.l=.~..*s.3]J.O.:.1Z.T...;.X@.....$k.x.F.Srg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{79c8686f-fc46-4f11-858a-.h.3[.M.h~i.rx.S@. .=e.2.. .$...V.r..?^...^b..dv;.<2....5.E..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.......0.$I.P&j....i.'i.u..(\|.7.H..IB..a.@....7.S._....=(.).Z..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Access2019R_Trial"]</r:a..6.....Xxn2.>f..^.5.<\.\|.< .;.).WIa..@.OC..".R.I..P.&$.p.\.9ossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200..k.z...Yxt<\rf.l....7K.\|..p&.;...N.)..gRU~..3...A9..#.b1.L.K..kdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI..b....-ZDP8=...xi...vE.R...).{6Q._.c..f

C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26133
Entropy (8bit):	6.640953086731699
Encrypted:	false
SSDEEP:	384:SvxoZofs0RLOrV4Ye6eB3vBVBQCN+nFpgePcrTz0M7CyHQAJjGpUH7SBR5O:Ko1nyo43vlQSopW/73HdJSLI
MD5:	2E0200079323DBE4F4C94377ABA7F9E6
SHA1:	AE3B609D2AFAEE95DEC24CE8A90C6D40B75D99D0
SHA-256:	F78F3E9382293B03C73651B8B32E9FFA601241AD53F097A6A653175DC4647834
SHA-512:	62EDF225B9B49F8C1D2DF1DB7353078F8448FFD5E51DF0A883A65BD87E956411DC2C84F1D4891CF7918D4FFECC9C62E4D0DAF21143F552216CFBD7F5236F6352
Malicious:	false
Preview:	._..7..q........>....t.m.nh.Qt.wT.=p9..ez.....w...`..+..v:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{17b4a1db-92a1-c4a2-0c76-9bcacc7f7a13}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..Y.2.. .........b.\.. ..2.4<.]{..]T.GbI...n.......8...].&..o.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office9E9BCEEB-E736-4F26-88DE-763F8V.t.<.T=./O....j....e.n.9:.V1....#<k../f......o...!W.o..}15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..{.'.,2..IQ.....`.p..i.l.:$.."..>V.h8)..<d......w....H.{.;/TM/v2" value="Office19Access2019VL_KMS_Client_AE"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="h..G.'..j........{.Z..>.O._t. d..]V.-m9..3,.....$..fH.e..jiority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845L.u.?.#\..F^....?....3..>.tj..9.r..q;

C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11965
Entropy (8bit):	7.016774482644839
Encrypted:	false
SSDEEP:	192:gtLNzSa9qpF2ySvKG3c/2/Vt4q93ag9bYCu7JyL78jz6:gtLFSa6EySyOuC7t9KiYCG8vq6
MD5:	5A4C504F606F1042F9D864C0874EFFD4
SHA1:	7EE124DFFC04977F21D2185CECD652C2587CC744
SHA-256:	A94F5C82A0661FCBFF12455845F7A0049569B61BBFE7813CE5533B34C432F78F
SHA-512:	695921097EDB0DFBB8D434F43B21B308777943032040F139A70EB4005CC2C7C8C7C9F0150DF1D00E90D50877EDF4CDB3897573084C21FED4DE80BBFFD1A75EFC
Malicious:	false
Preview:	.4M.{&Ft.fX.{......'..i4m...R.UK.u..f..3....c.6>H....u.M.t.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{6d013ecd-bb60-44ea-b35d-"...!hM/.#[.u....G.z...1x{.u.Q....l.M9..=...S^1T..a...././.Y.kWs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/P...,fT.?i6'.....3I..`?0;}.U..I.8.}...m.....n.=m.....$...=Mitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Access2019VL_KMS_Client_U..xqY".~e.d...N.zT..2f!.!.S.)..?.Zd...N....r79 H.....i...u.propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w'...#q.(. .K1..O.`Z.2f\'Z.Y.>..t..b...z.W.A.n:u....<.o.fpy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlQ.....xW.$.B#....L.D^.._iH1V.o.0*.Q.rm..

C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9954
Entropy (8bit):	7.09444931547987
Encrypted:	false
SSDEEP:	96:y4mqA0qssMgRAelsROmK0ipYNlY1CpPigLcaxy8zR2GehQajUD+ZjV+AaRGTxREm:a5HlUOhxps8UPTjz2nQaoUjVpEsXd
MD5:	8B0660D97CAA3F2EBFF90A4DC788A8A0
SHA1:	59FFD6A8A1C7B04C8B1185C86C3AF5CB040956F7
SHA-256:	2678ACF60302949A68DAFF08C55F5BB1EFF2628EB1930117FEE7A92FD6C60883
SHA-512:	A5BFEB259A3052A75B4967761E08CC0C7BBDD763736D0042ACE4A1740F0D5A312293B7568535CA88E17A9D786E31E2F31AC546BBCB489D3ADB5EE6AC57A62116
Malicious:	false
Preview:	.c..7....O......){.h2y..+.'Aq%.....e...7..oT..e.I..wY.>b.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4d996be7-595d-42bf-a795-Y...n...........y5.58(R.g.:K"&.......k...\>...Sb,.D..+.-..=}.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/-.{.P.$.....@.._e.\|v2^. ..C~".......,....h...dI..7.l..c].y-.r:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Access2019VL_KMS_Clie..i.MD4..K.....Q!.4g(Y..v.79.....(...L...`U..z..G..D.43.<r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://ww..A.&......._..D;!.*f(C.f.v.J........d...x...mf..`.T..@^.ac.1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRs8.Z.p3...j..[..VV+..e.g.....^..........

C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	10967
Entropy (8bit):	7.124072528626546
Encrypted:	false
SSDEEP:	192:qjsPGFy28VTXw8Uzrr3jX0wgdHz5IitPT:qK9hdXwJTjX0lz5I+L
MD5:	C8E7D8F1B2A4045B2D9A9CFC6623F41A
SHA1:	5529499A5A766293DAB1C2B197DA1116BF837275
SHA-256:	6ECF857B1AD4FE8CCF2945B1BF93180F4CAAD623E40CCCB4E2D8D7FC1608F193
SHA-512:	9306B4105E40E3F2FD0D66C7BE5469224AFD9C004B2F0339A21CC6854F080A0C70636D0ACD19A3900DFAF22FE62F7BDB7A1078AA6EF60098C896BEC25D8E3781
Malicious:	false
Preview:	.......j(.+.....n...>.;.3(.o...{.u.1.......;.r'..GA.....M..;.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{5e28aa59-b21e-48f8-9614-.!P...\.+m.<..<...3..Gf.-.9{.xv..b.=.!....D.b.:...-`.......$.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/>.\|...!.xq.....f...z..K7.f.1'.kv.6...qW.I....r.~..sV....L..a./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .#C.....h<.7..#..o..Y4...;.@z)..v.7.w^......<.xw..eJ.......$.s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b......T.zk...........^/....+2fA..j...8b.n.:....o...JW....z.<9.PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/40#s......k.....&...o...+...`5==`..>.(. .

C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26068
Entropy (8bit):	6.622147686131091
Encrypted:	false
SSDEEP:	384:moKP9G5oI+MNNYOccF6bMO56/N2PjlgWPc5sP8uLCOANydlvkQlBjUwotmsD7sPt:2o5onMbJDOQ1SjDONyd4XtrqbdQVS
MD5:	3E1548B336B5BE57CE2AE5EE31076E42
SHA1:	0EF0B36441DCA2EE6B8628845F20A5BB96909000
SHA-256:	C0EF5429E9DB379E0BE4F32EE0D4416B4487F7122F61697A1431C44CD5AD7C95
SHA-512:	A19B2CDDBF18900C3175C4CD1948AD6F662A6CFB1FE0A085DBD0912EA37B17F503A0A9C623567F99359BE4468D727D08109D2AC97FD7A9470621D88EEBD7EF27
Malicious:	false
Preview:	..)=o'..e.K.D.r.m.../........"..'+.4\|B77.../[.qP]......O.r...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f27658c6-bfe3-fe01-52a3-17825255f257}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xu..rj2...f.W.@.(.1.C.=W...\.....7...A.PGX...+T.l.K.W.{.).J`....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office385B91D6-9C2C-4A2E-86B5-F44D4,.9.j...C...D.!.9...5........%..2#.2b.e1.I..\.#PT...z.c.@)....15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/Xj..3.....!...H.;.3.o./.......k..ib.{).'f.Z.)K.yW....<1.8_...$./TM/v2" value="Office19Access2019VL_MAK_AE"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://wo.l9<...\|.M.N.`.....}+...?..-.[o>.6..`d.P.?../.....)./..=....<sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BY.,ai.Q......m.m...c\.......q.[o>.6..

C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11932
Entropy (8bit):	7.094937985216304
Encrypted:	false
SSDEEP:	192:wpn1SWJRWMfuUH8Tdle91vn7bwAvK1u2y8EqxAMOoFqKEWf6:wp1SERWOuPTdlE1v7TC13EqmgPEWf6
MD5:	D24887112B8E308A58FF91C7456A502A
SHA1:	48E589501A680A1F234AB4704E2926641B8419CB
SHA-256:	67AF79A844F4AC21A23641E63279D4A5B99CED74A06ED9E4F944B4CE7C1CD254
SHA-512:	99DE5DB1CCD0B0A9500373A941FE9BA2A86E7709042CA4BD4FDC6108F10CFA96AC23E1B84C1F9772E0A9EAC682C912BAF4E17225BBC98EDAD936B093D22DD4E4
Malicious:	false
Preview:	P.VP..k..}.......q....&...y9.......5.R..05eR.l....J8S+..P.u.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{0de45b8c-05a9-4467-9f02-...\..3.=.9.....F...L~...*:.......;.\..9c<..P./..}`mX.SD.j.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.~.C.K..$.@...[..2.@/...v>........e....c:i_.g.K..G!Jh.O..<.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Access2019VL_MAK_AE"]</r.M.4.C..y.~.....o..[1....,%.....k. ..od.P.r.....?.{..L.t.yPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2...C..)..g.~...[......Q:...ui.......f....R1of.h.R...,jr....D.YlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZS.e.X..D..Z.B..4......g{....w.........]

C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20276
Entropy (8bit):	7.165170091273179
Encrypted:	false
SSDEEP:	384:a6U3Yn7uyPotZ+RXmcUZGGInD4Bv+aGZACcQ77:DKyQtZyWUGInD4JX2
MD5:	5B3A355D7347434724A1E1305C8B5F5A
SHA1:	E5D1979887A970E9D3E7EB4DBC0B6841178D8D22
SHA-256:	767011AA77727938D1F48F22C5B739C6B7E4D21FF25A200A17941AA678215C0B
SHA-512:	A11DF007FED045CFF5875D0E7BF6828409C0FFFFE0CA16BE8315B898E8CA9BACF0DAA065B3013218060B847628A06AC7D97939BC7DDE88238218ECA0468BB15B
Malicious:	false
Preview:	...9b\......d.._Cg....N#......%U..1.nf...o`......^..aOm.3m..~.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b476162d-3e18-4c32-a82c-\.h=?....RA../...8"....o.....}...'.1v...-7.YW..h?.@x5.@7[.aPs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/!q.*.V...L#..{..\]$kY.G(......}W..w..d@.sb......^..;pm..\|..."L:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Access2019VL_MAK_AE"]<JQcd3\|......~....hm...M"....Z.jM..%.:(...oI...[..]..w.&.a/..}[rtyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.orgJ.i5m.......~..AChm..`(......&K..3.:1C..\n..1...b.."RV.r\...9gBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrW?p.Li.....E.B.. ,.bk.i.....4.BD.../ J

C:\Program Files\Microsoft Office\root\Licenses16\Access2021R_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	25770
Entropy (8bit):	6.623866263279025
Encrypted:	false
SSDEEP:	384:scKdtfw4PtMze+fpCNjqR6mY+kUwD5ePlHMESeXWH8I8j6AMiyQzS/BiaNDAG:WPepSjq4/+ZwDgHy/8tG
MD5:	C365501A93DA2E658C069C6956043F0B
SHA1:	9818D3CF4675BA14EF1B890CEAE81583FA8FADAE
SHA-256:	ED4589EA1763CC84DF12B761B5E19EEC710BBC845EBC07C646F43F8679DE3365
SHA-512:	00F48A49D518675C9E66E480AEBF633AB69228C85C36AED3CFA7B041B01280D8FB6111054CFBD8F9FBDA240483AF2F6BAAFFBB6048AABCB0F19FDCDFB2CCBB74
Malicious:	false
Preview:	..2.. ."b.K<.W...9B...^..^/./a...zHc5.....`...n...?_"..=0O.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{221348f6-98f5-9f22-260d-f5fecf12516f}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.^..5.. a.Wu.H...e........{.{6...PH.O.....d...'.X..;E%N./=M..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office9FAECCD2-1744-47A8-9B67-ABE26E...rl..RD....[..KmP...O..]..}t...r.e+....Y.@...n...:UoE.ft...15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X........t&..s.\..Qg....C.._8.cn....3J,`....J.f...iTW.\|u.s.X`w../TM/v2" value="Office21Access2021R_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://wwwZ_.F7.d`.Z ....u'4.....}d.s$...&.)~...PZ;...2.X..!X>L.tk...l:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BACB....m..4$..\|'...'....T..R2./r...&.4{.

C:\Program Files\Microsoft Office\root\Licenses16\Access2021R_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11933
Entropy (8bit):	7.131693671684821
Encrypted:	false
SSDEEP:	192:rjlFqxBogUuAu9CIL+fDceltpz7BbOvZyc3Q0F2jn8Oa:XlFqxGaCILiZvz70Ba0F2Q
MD5:	14A1678C69853557B26DF959577FA7CD
SHA1:	D07D00D833D75605211A3329034BC4DB40452584
SHA-256:	3F51DA9757E894D00D31CC9FEE4531D954044ED430F72967F260F8B0AC7B0443
SHA-512:	1A585BE7D88A9FE2FBFC9DDD242714F0D1B2D26945DED7B4728CF921AF68D500C072CE5E1AE5356F930D140E2ED7F2B43EC3FB03021FAB7F56EC4FEBF2B21D14
Malicious:	false
Preview:	z..T.I...!.q...].X..9.;L...f.E..W< ..........H..=.N.^...u..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{aa112a71-06ed-4401-bd69-..&......g.:..D....a.wZ3.e...Nh..........t..W....-...v.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...G..i......n...C.L..m.0....a.....zX....R.....C...W....i..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Access2021R_Grace"]</r:a..-...T....:.v........X.9.}..n....Oz{....].....B..F..K.....o.ossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200..pQ..I....4.:..{,.=..O.9Z$..E....V)3...G.......K.B....x.kdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI..yC.......0.U..o:.4..A...&.r....G y...

C:\Program Files\Microsoft Office\root\Licenses16\Access2021R_OEM_Perp-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10971
Entropy (8bit):	7.150656872851176
Encrypted:	false
SSDEEP:	192:GIMBbvj6iQVvsXY2YJmBNiU/o2zG19RE5Ahu326+zRke0r8/1nL:GIJ1O/Yw1mRSQy2Lur8pL
MD5:	66A15069B55D0FAE0F069F014B01AB1E
SHA1:	54DB7A3832E3258B54B1EC84975DE601C92B7249
SHA-256:	B1446A8087A4492B099511FAD1CD49CFB02209C1F5B94017A50DCB6C049D41AA
SHA-512:	F97549E8597D59BC1BB32ED16A74293F4F942050C3CF2119481A788450D62DB07D88A8ED5BADCF38EFE3D212E68737612457E78FFA7F1C66EC46F445C54CDFB2
Malicious:	false
Preview:	"_.Y.r.;..-B.u.....4....@..t....V....5X..}....R...#.1.b`C=*.erg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{1563c8d4-62c1-478b-a957-.....k.1..-....c.....e..K.]..w..O.J.1V..t.EC.nI....i..:.)).1s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...J.x.....}...9..........`..s......X..b...).U>._i..4.l.7zB8'.c/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ...+.g.j..!^.\|....,....C..&...[.A..yZ..}.....0..(.%.7}.)).1s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b...4.Y.?..xg..U....t..=.A..T....G....J0..".>E..{..5.t.0Wt(...PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4...U.@.3..'w..y.....L..8.I..[.......].

C:\Program Files\Microsoft Office\root\Licenses16\Access2021R_OEM_Perp-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25775
Entropy (8bit):	6.664950203452039
Encrypted:	false
SSDEEP:	384:9XVAxMR4Zzd/gXDtIYCNeba/u4VePOB/0YKPrAuWVtzYGDqRzkc:7TmZtSJS59wjYz5Mkc
MD5:	AA350B13F3B3170F8E09C2EA72AD4355
SHA1:	E615B1ABE276D4240899B2DFCE22C3E8F6E63058
SHA-256:	9CCF412367A406C88F18E6A4AECBAAA07373429747E99DD731EA078ADD7C31B6
SHA-512:	1BE991BCEB9DC3C97EB030D08EE599EC1D41797A6E4F3D04C764B447A01E6BB5BD2FF941765EC5E31874994F8031F1BAB35A624458A48550018C4A180AF4832F
Malicious:	false
Preview:	Kgn.....g7..............+..:.m..]...K"b%h....u..(.:....5.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{ebedd2fd-d16a-7a1d-99bb-38530a8f22de}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x......p+.....Y.N...MAq..5.\..(..$rx1l...Hc_.g. ..f..0..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office8B18231C-A857-4F55-BFAF-87998........Fe....[Q..[......\|.....x..[..M1(9H._..\|..0.0..l...$.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X........ {....A[.M.........l.#......9;;n....>P.(Q...s...../TM/v2" value="Office21Access2021R_OEM_Perp"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://.......m#.....p......O^.....'......? u._.B ..6.n..5...3.><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-........@s................+..v.'....

C:\Program Files\Microsoft Office\root\Licenses16\Access2021R_OEM_Perp-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11926
Entropy (8bit):	7.060753677642661
Encrypted:	false
SSDEEP:	192:r7NgxLYlQqLrYpbycyVjVvMib8RuB0weAJQ/cF:VgxJiYVkj5V/zJQU
MD5:	8C50DDA87E6758660C0C29168ACB0D50
SHA1:	080756893C77D0D5C9EC8B54DB80807428B246B4
SHA-256:	DE2223F94A1FC6017B8581918BA1A6B24292C9016759B945E064C1E73CC21CE1
SHA-512:	3356949CDAA14D57030A644CAF614E7E6A4BDD1BD84C1780F7DF5B6A40C64A0CB05C77ECCF10F39F08CBA92998B5A041051688CEFBE476CF38B52C62AAA5E61B
Malicious:	false
Preview:	F..7..c..@.$...H...ld.k..<...:...4Z.<[%.......c.d.C."i:...E.&rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e2334a41-ad60-4829-aea6-...m..:..U......K.@f5.3..!...-...-LGcK+...M....+.R1)..1...N.F.rs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..$..C....x..K...(/.b......>..q.wHYu...1...u.7UT./p#..R.YNhitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Access2021R_OEM_Perp"]</.B.e..b..F..$........\|.a..?..H/..2}NhYl.......g.g.`.s 8...[.ntyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/.H.;..7.[.$...W..a...k..2...c..$INq.$...K...Q.}.5..-+..X..-^cYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZ.7.?.%........8t.u...]...%.......[`.n

C:\Program Files\Microsoft Office\root\Licenses16\Access2021R_OEM_Perp-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20270
Entropy (8bit):	7.233552810416598
Encrypted:	false
SSDEEP:	384:IedtWon4myImpT5I4vkarRuJmaGYJjQ9ZS4PJDRr+s:hWPmyIm118arsJmaTc90kDcs
MD5:	71319CC46BF6142BC4DE29D0537965FD
SHA1:	DB8887A88D92162E14D47C320A3A1747D6EB6F74
SHA-256:	30B35F629C99E0FCD4324A096F7B830E96853EF026C064B24ABECCC85F13449E
SHA-512:	0348AA630A7C751E19B28D6C317432F08416331EEC8A0B6A096948326FF87D6BE17C5301E4F546776807964E532479CD0C802822073CF9701F2AA45800006706
Malicious:	false
Preview:	..h>..g..........`D"\|....q.1..+`..@..:.h...&Z.......b.H...org="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d067b530-0277-4571-969e-<=.0..8.......MI.=Ns$...$.r.i.R2v..P..4.?...t...!.#..\....;s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.Z.-..G..........t.i(...,.v.i.Zn&..B..i.j...&Z....X....F..J':title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Access2021R_OEM_Perp"]a'.8..R........IJ.pH/.....s.0.R9i.....p.}... ........~.....%ertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.or:'.2..%.....G..pHR.......s.i.T.i.....8.N....W.."....s.l..aYBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr.R.M.>.......Cg..GF......].k.[%)....

C:\Program Files\Microsoft Office\root\Licenses16\Access2021R_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10963
Entropy (8bit):	7.14116073199371
Encrypted:	false
SSDEEP:	192:mm+2eH59Qh5y6Mxhuzga4GF1xs5cuEv9pX4:m2Ou5y6KYy6ns5evH4
MD5:	71BE10A6F7702A2B6F7A81B857BDC9DE
SHA1:	AFDAAA7C77194715413F6B33C5217BF2DD683F03
SHA-256:	2F33EE66A84CFE112E01FDE659C910E843462FB45697F859D087DB5F10846F87
SHA-512:	EDD7B61CB5A51C367DEC9B359589A2819F5BD5A470D2DD5EEFC60267DF990A18B24B4F9C14F4B6EDCEEFAF1ED150FC81A876D0235932352CCF387129A7FF1181
Malicious:	false
Preview:	1.$t.....xg..0....Q.9o.......;\p.. ......r.=....Md.WZ.X..../rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{a99ad803-f902-4022-8ca9-.X....[.m;..{..F...3>.M.....8K(.9..u....Z{.d.U..d....d......{s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.9.g..%..!V.R/.B....}$.....<X(..e..g..Y..&.t....FP=..z.B....)/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .........lk..0....\.{w.....iIw..-..~..B...r.:...cF!.CF.E....{s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b. ...,P..;2.--....'.>/........U...1..*..q..$-......Oi<....o.).DPKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4...x.5..;m..i..\|.7.:.........>..e..b.

C:\Program Files\Microsoft Office\root\Licenses16\Access2021R_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25773
Entropy (8bit):	6.667307846509147
Encrypted:	false
SSDEEP:	384:Rzh8KIJYcM4ZZRgsWbTFCN+LQQONePWCxyuf/l9Qu3aXNE13HqigKoK3mPb:c1VgsWvFSlQO4jjI61tDyb
MD5:	6F9113A20F7B3DBA3DAF19D349A9DD11
SHA1:	FC21E30368B3EA97227FD4672B82F664E744259B
SHA-256:	577C165D13967337D04F44E215E923DCF26B7E481D3B8C8648C7B089AFEC6D00
SHA-512:	DE0F348C96C2411BB86724D16D27A406FD2F4565928125EB429705DDECDECF6653C8FE4AF447C563717213C5E587DE820C05C4B749C05F58CCEDEC3AD4D2728B
Malicious:	false
Preview:	p].W.&.&.....$......O.]B...7...Fq...d...o0M9......0.....t..T.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{33120d94-3a34-17fb-e7ad-c39f25c7f29e}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x....3.w....;...........Nm\.IV........`W-............@f..Q..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeF634398E-AF69-48C9-B256-477BE..\...j..G..(.......LE...`Z...v...b.O-i#.%.......(....J/..E.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..Y...e...Y./.......@A...cD...t.M.+.Ko>+.'.....0.9..U...jC/TM/v2" value="Office21Access2021R_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://ww.....,.9...I..&[......t..2q..Z8...,.U.!+.,Y].....g..... ...Msl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BA..Z.k.~..._...V.......HC...'/..Z8...,.P

C:\Program Files\Microsoft Office\root\Licenses16\Access2021R_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11918
Entropy (8bit):	7.064478841835815
Encrypted:	false
SSDEEP:	192:iGMnaMeuF8GUHz3bBsr7/mjN4ilbqmT9t9kgA6jmFKdkQwnv2pcwkbNB:58anE6tsf/EH9qML7ADNQwnv2pYP
MD5:	8D41C5C4D01B33FC5EA39F0A37E4A50D
SHA1:	2E7BAE9E8699844E88AD9344BE7E722155856E8E
SHA-256:	D19354B03F1EAE81DC397C84196C36AC4B5B353AE2794EB75C81C6229F9E8C8D
SHA-512:	7C18A54D163CAA5CE215417CEB26CD7988832750E761EEAFF8B2419AB481117E0C027E325D6157897C8381A4620B8F2E878C4A07929C798EC2C2CAA20362B15F
Malicious:	false
Preview:	.'."..20~...VZ1...$.HF.h...q..b.$!.g....0(..X....`.@...h.e..{.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{7d624f49-e927-4428-97dc-4.u&....#u"....La.......~...r..'.=7.8....r........I.a.....(..dYs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/H.Y1.... iO.....2...`..O.5...v..`.ag...GR.b...T...-.G...+.4..2Citle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Access2021R_Retail"]</r:m.Ls....`#h..W.0...r..b.g..%..2.<+.).Zs./*.P....'.....:.x..\|NPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/20<.;....~"h...0.._..u.g...#".$.<2.a.iT.5...f...w.....~.<.:knlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOE. '....C!T..tg?..V.P{.I...,....)#.+.B

C:\Program Files\Microsoft Office\root\Licenses16\Access2021R_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20262
Entropy (8bit):	7.234922773593017
Encrypted:	false
SSDEEP:	192:lsCyrIk9nUxA/Xm4eVZygfe4X3z/QidiugJ7MlrYhspKQ1ndroS97ZpO5J3z/VNx:aCmU0m40ZyoeS5diugmleMPBjb4Xqs
MD5:	C0471B9C71081E3C21ABC45A23E4FE10
SHA1:	86DA68D00EBC48BAEB5ACAF48D8B4B2B1D7AF1E3
SHA-256:	CA8C247D28BDF00A32234B975B39652DA5651507DA5250E5CC325C806540F77A
SHA-512:	5ACDE1A83AFC3E44003B54FE311C534B36557DEC0FB454FC321E6E3DAE36CCEBC106665D2F07CC095D1EDD461D9A685CEA4667D9CFFD47CC9A4680DB84B22A18
Malicious:	false
Preview:	..Wa.....T2..........x.5..(.(Z_.,DJ............'...>>w.}..[.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{fb309e77-4501-4493-8974-)1.k......d....\E. .y.".+M..c]\......[....V...6.fI.'..X..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.S.r...!..........Y..,.>..*./^..k.....G.......'..M.>e.l.....:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Access2021R_Retail"]</:;.3...(.R%...........>.). .zOX.6Bm....N.%.R..E.9..Gowu.u..E..tyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/z1.m...B.O;............". .#.^.6TY..Z.C...H........zf.\|.....cYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZ.N.i.../.........c.....c...!gQ.vf..S.

C:\Program Files\Microsoft Office\root\Licenses16\Access2021R_Trial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11475
Entropy (8bit):	7.094282377392326
Encrypted:	false
SSDEEP:	192:nr5BKfQQAeuimgazbSM6mANYUnSa10vgzkF2k:r5YfkeujBzbSM6tKGSbX7
MD5:	1B0462092E5681BA0B0DB652BEE3D13F
SHA1:	74E2D7A93D4BE78A3AFDCD71A9A4C66516F21832
SHA-256:	36310AF41AEAE41E851B853F9C1C88D8A73A9B85B5E14E5FDBB887F807290241
SHA-512:	A0C76345728854296F9FF6759B75699768D0DB3A39FC50ABF09435FCD66A90CF5B2DF576EF491833BA10D097EB6E0BC7449FB7F79C31732ED1E39BA28D0C8426
Malicious:	false
Preview:	..+......%3..t..y7....JO..8.....=.`r..7i.c....H....o...s......rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{5f287d4b-a673-4b3f-9bc7-........f4..?..)yJ........2..9.Ir.v:..9m.!D.KZ.....N1Q........s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/!..x.>..\|...k..z)V.T..F.. :..*..zY&..Ld>.y...Jg....xIT.&....../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ....A....1?..t..f+..R..E..0.C;.H'.G3..~6._...W.....\|..........gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200U.......U ?..?...Fe.E.<K..b.2&.[$.ua.TL1."#.93......o..."...E..rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV....X.6.@a...g..\|>s.W..m.&h......G.>..d

C:\Program Files\Microsoft Office\root\Licenses16\Access2021R_Trial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25822
Entropy (8bit):	6.593410637404868
Encrypted:	false
SSDEEP:	768:tRV106z/znC12iLsvDxNderzpSlNk0uDid:/znQ2io7xNdCt4Nk0Td
MD5:	F57C89BB7B715D3A113B86076AA04700
SHA1:	B2A0FFAA433A8A75009B802B034834F248B53303
SHA-256:	96388F25D7167E4036981258A3B3BA70D46E5C143BFA647D79D983533A4B69D1
SHA-512:	D727BD8333509C5A4F78F9BD63FBA7EBEF2E13C404162E690ED738B1C93CAFD40C28349E896D38AD43510F63C1B81B04CB02B26B25955236C6C1F895592A5B4C
Malicious:	false
Preview:	....m..[ZP<.=.l#E$A?..Z..fh..z.....w[.#.eF...tZ......Y.m9..ci.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f46c14a1-a7be-071e-49dc-19000ad295ca}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x<f.h...XS+.t.s(.<.a..H._77........][.Y..)...{Q.G...]..'q..al..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office3D9144EA-17E6-4C34-9E64-B4C1E.I......v....`(.u.-..@..qk..(........=Z7@..s.......\..,{K.'x.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X#G..}.....{.r.g$.o....Z..ii..6.B..>Y.v^u.....dP.........du.[WT/TM/v2" value="Office21Access2021R_Trial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www.g.. ..X.Rw.!.,.K_I..6.JVK.&.....+..hF)...'..R...G.%"Y.('.l:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BACg'..g..uL.a.}.!sI:_b.....ld..z.....+..m@

C:\Program Files\Microsoft Office\root\Licenses16\Access2021R_Trial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11930
Entropy (8bit):	7.054107248742343
Encrypted:	false
SSDEEP:	192:sUYMJr+XOnDYaFOnVoFtDPQ5W7b0FNiP1pQ/4HjPeKTfBF4B61:sCNyypFnFtsUH0FQQazeKrBF4S
MD5:	B8EDC2F4CE1612DBEDC9A3D81648ED89
SHA1:	15721A492576FEBF8AEFF83B37BDD434EE046FEC
SHA-256:	44FE1D5E1F763EB6E23343A44CD10EEBFA9FBEF31DCAB26A6D552F3482689670
SHA-512:	4D91BA7A3D0B8716651F5646F325EAC8D014F5DBB513562E0ED73834B095BDAB49D8C738A8F4DE7C619E0D274CD83C1D207A3B2B1D0AFEBB92F912116E7E2E54
Malicious:	false
Preview:	$....h.'....X.q.I....6f._G.^..4n.(8..Q..N..CM...9.p....)...3H{rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{504e9845-72cc-452d-9522-.....".*.;.V.>..VT].g>..Q.T..#6Ng!...A..@..J.X....Y...P.....0W/s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..`..b...&....,.J.H..}2.T..\..06.o}..S.S....B...2.=.)..0.../.5itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Access2021R_Trial"]</r:a..@..h.9.z..D. .[H.H.f..]..H..<!h1 ....]...[@...3.+....+....)B.ossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200.....h.'.z.... .&i{e.m..]Q....<7\19...2......v'..f.[.=..o...>b-kdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI.....b...F..i.M.2.wl.,..st.`..\|..$(.....

C:\Program Files\Microsoft Office\root\Licenses16\Access2021VL_KMS_Client_AE-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26054
Entropy (8bit):	6.635568149480212
Encrypted:	false
SSDEEP:	384:js9hEGJcwSMjOv6IOlOCeHXlraevc5d4uk+V79rbIbA06W7ChuvdpEOuKzimy+q:A8GBOnOTEXYFCFpz+
MD5:	14B2CC35EE125AE97D4ED926C4BA1549
SHA1:	84F0229F2C74B64651A8BB8DFB37AC3EE53C92F7
SHA-256:	495CDD9BB8AC42BDCB41E0925785C29E0FA526E80400E42666C1DDE7BE79FAEA
SHA-512:	F28146885D8E32F40494E70B7ADEAB98464F0969AA22CC5F2D6B1509B03F60CD068F928648900064B26CC66F0B8B1EB7BD6C0FF5865769B2A7CCCEAFAA2DCE52
Malicious:	false
Preview:	U......s..D...lWg.<4.b........+...N..~.1k.qig.V..C..B~.q.."..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4c699502-fd3e-720c-cfc3-19e9022e029e}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x."rJ..."..S...s\=.`j.'..D..zY@\|..6.......^;.emh.K.....Xy.9.. ...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office1FE429D8-3FA7-4A39-B6F0-03DDE.z.....?.e..`\4.h&.2...../TF>...[.Cx...7x.mI`....\..H3.3.f..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..P....0......gP..bt.$.....9WX$......1...`p.oow.^...T..h_.,..../TM/v2" value="Office21Access2021VL_KMS_Client_AE"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="h.:l...h..L...lJ5.y4./..:..e2...Ki..0...1j.'pv.W..B...=.,.m..iority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845.z^}..^.....6...=".s.@..e..v...S.N...

C:\Program Files\Microsoft Office\root\Licenses16\Access2021VL_KMS_Client_AE-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	DOS executable (COM, 0x8C-variant)
Category:	dropped
Size (bytes):	11965
Entropy (8bit):	7.098930219127265
Encrypted:	false
SSDEEP:	192:o6b0N5o1HSDUhjPO2YFKCAAhlwR3QR5XwETm:jb0j8SDUhzO2YItAhKe/Xy
MD5:	D5C8D82D7D8A6B5F3B96D87CEED86320
SHA1:	5DFBC95DD3D7D0351ADFDFA65FCDFFE8FD266A72
SHA-256:	8C14D2919FE87631C50C57F74FACBAA5E0D7B54888AAA30BD84746AE0272297A
SHA-512:	D374F4CCADBEDA6B51881CCB1A0F59CE6CAA1A9FB9DBA114807BF663FC4AFAA884B1D861BC29638C7A36492D728139EC1EE74C2565F0385B6E9FBD40D39FF290
Malicious:	false
Preview:	...e.K.I.V.`...k..o...p....>.....e%O\.u.b.rn. .....a...C.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{71cb0f3f-13dd-46ca-a501-..I.k...Z...n...4..>.J.f.F..f...T:5AX.7..4. &......M..;...\.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/'.<...k.[.g.<....(.B$...-....f...d.'...'..m..x.sm....0.....itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Access2021VL_KMS_Client_".S.f.T...k......)._".I.<.....B..Cga...k.x.cE.> .....}..B.propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.wP...=...Y...*....).Qn.I.A.7..U....aJ...k..0.Pb.$.../..(..Q.y6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRl&.$...u. ...8.....U..$.U..>.Q[....kn}_

C:\Program Files\Microsoft Office\root\Licenses16\Access2021VL_KMS_Client_AE-ul.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9954
Entropy (8bit):	7.120437825760395
Encrypted:	false
SSDEEP:	96:p2qjm401XngRAz2VIRJmd1v4knoxegPap/KsujxGYXn1opd0Iz9L3HZlUWoAa5Vd:6we2VgJy1vRGLF1oph0W37m+rF/i
MD5:	4895BF95723B8ED55C543606693347FD
SHA1:	0C9992FF68ACC45E4FBE6EA2BFCF5C4F0B9FC83C
SHA-256:	E2826898755A83AE983E43D8192D600254E5FD906291B9C0BE5B345E290F0CBF
SHA-512:	AD696608E0CA1C3598F4B61C6A8E9F28123563CECB5BFAE35009891E01EE59C303D66E5A39644C53C2D77BA33D57656F0B40071AD6AE6DAA9A49E61A2C4BC5DF
Malicious:	false
Preview:	j}.......u.'~...7._.8.w_..eu ..'...s.(L.m{....a.....DQ(A..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c383bdd4-da25-4366-87f9-........&.)5Y..y...iL/...o&#...h...,.&H..:r............<B.Es:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..}......D.{aKZ.).K.s@~T.gz'...`Z...a...g$.....C....PU'...r:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Access2021VL_KMS_Clie.o.......:O...m...iG{^..=3<W.. ..u.eH..x......G...LL-K..<r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://ww..G...... .d8IA.m...i]u...=N.,..+=..>.)N..n4.........sV*..e1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRs.\......_.`#@S.g. .Uyqs..2Z. ..j3....M

C:\Program Files\Microsoft Office\root\Licenses16\Access2021VL_MAK_AE-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10967
Entropy (8bit):	7.1615717418243765
Encrypted:	false
SSDEEP:	192:2z/zIwEu4HOclD8JbLiu0BV/wyFqL/YgexkMJK:2jzn7qu5iu+1efexkMJK
MD5:	2320C2E52C8D5FE8657E3094EADC89CB
SHA1:	39E3DB63211C617A139815305F57C242F54393AD
SHA-256:	12C28C1680D3E196C91F06987C24F07DC705C3DF553E6FB593D8D1F276FEAC8F
SHA-512:	98B569285D50B435D14677CA4B921DFF254D0A0A1FFEAA609203086BD8DD4DCFE33D751E10687A72AA5CAC6FC3C6079FAF1791A1B4C9358E9F703F5BDFFD651A
Malicious:	false
Preview:	..;...........ts..ip..a`.....i...q#7.........sY..S....W....Q..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{9dd93f8d-314d-411b-94bf-..............;e.N6-.@98...]j...>:!7......H...e.........R..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.p...6....U.)?..d.Z5i....n..6fq...^.....:v..E........\../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .C.j.........uz..dq..'j....Y;..a..=..W....t\.......C.....R..s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b.i.u.C...*.kS.l...Q q.....I..v2?...k.....EQ...W.........r..PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4.C..........A..T.q.iyu.....F...Nf."...

C:\Program Files\Microsoft Office\root\Licenses16\Access2021VL_MAK_AE-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25989
Entropy (8bit):	6.64285262145639
Encrypted:	false
SSDEEP:	384:4drN1+wy2Z4gRmtiOOgMB7rJjL3NXeeo+6H1OQawTp05WDmLx4jWZhRFZoDBP2T:4YwWoI3MV13Nu1O4TpN+pR+P2T
MD5:	D02A07F147687CBC08CEF7075406B905
SHA1:	92D7EA8E04E5DBE43CDB9CC45F88EA352C9641E9
SHA-256:	5236CCB524382E66B73F0D479002C69AB9BE8B7393C363D3637E74E7D91FD0B7
SHA-512:	18FDD95C6DA84A2EF892D1D634F81065E510B9640AE7CC1FC6478D1F7FEE7E5A9BE1A8F94B36BA08D8F0D9BF7F59B5217F30F5F91257C52B2ADD807599488E2B
Malicious:	false
Preview:	..iJ$E.pD.h.m.d...L[.J... .x..n.....Rz...."..HVT.g.y.z..kV:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{2dccc0b6-4c9a-f9f8-7426-cf9001d2e218}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x^eA&O1P.(sS.!.r.>.....I..W...t.t.._).....=.....?.....}.3.h..nO.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeAE17DB74-16B0-430B-912F-4FE45.L.bD.j.ZVe.W.a.7G....A.M....r....{.....Ti....p..RIL.m.8.!..z]15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/XADcgZ.e.\|4..'.f.-]....[.I....l.1.. J......a.......AT.M......U./TM/v2" value="Office21Access2021VL_MAK_AE"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://wD~.8.?Z.yiG.5.m.vp...6..hW...a.w.&.....z..@.\|..G]U.y..5..`.<sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BrJ.xDj..>D..#.1.{.......T....7.+..&....

C:\Program Files\Microsoft Office\root\Licenses16\Access2021VL_MAK_AE-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11932
Entropy (8bit):	7.059144334229725
Encrypted:	false
SSDEEP:	192:lxYS5KY9UB55fxrrcIfGiD2RuOC6Z0p1p9a+KQ9IPd:leSgY9sXfxDeiD2R062hnh9IPd
MD5:	BBF245D046D7F52C8E7A7DC4E038CF05
SHA1:	FF9B452DE2ABB46B0CA0B23556FA69493531FD83
SHA-256:	A18C8D91AE161CAA14F60C99C44DAA5F50ADACCA8233D335562EF6A6C23B98CF
SHA-512:	5C5211F5D24ED591F68011BCBD527FC8CFA2D442E39CB468F3845524B83BE3A3175E69B9B525FE7F73A8D1993FCB413AE49D25E8DC994E085BAEF44FBD47A299
Malicious:	false
Preview:	..>........\|.l{.=....)a+..m....J..;^}.......#U.Hu.u.iw...P.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8d40b1c2-34bd-4981-bec2-.9%.b..J.....7.z+Qb[..q-=..>.h...S..dNs.\]....ki.a..BBW.A..O.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..Y.Y..5.....c. x.~.... jv+.b.{......O\-..L!....5^..b.x.p4J.....itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Access2021VL_MAK_AE"]</r.=z.l.......\|.lx.#Z..>N$..8."......#.#.......6K.I..&.#'....Q.yPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2.l$.1.......r. x.^{...5Y)..aY$...K..pB...Z......Q..@.+.P.U.a.YlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZS.. .8.......v.O..Jm...tW.&.c=+.....y..

C:\Program Files\Microsoft Office\root\Licenses16\Access2021VL_MAK_AE-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20276
Entropy (8bit):	7.20788685940634
Encrypted:	false
SSDEEP:	384:bTNyIfYzgTr0XCyb38SMqolFe5UKPveKaKgWKMJgTD:b7ffr0Syz8Zlg5PvezeTED
MD5:	276039C8D1D01E3F36E11DF2BFEF8A8D
SHA1:	CFD4BE4A9D5AF65FF5E4C003A5C14CB3FC83C867
SHA-256:	7FAFD370AE0E3156E1B14A83FC0B198C9D8CD14F58C9167BF33CE2C1E3C1D22D
SHA-512:	1CA42E667B9290DE6A565B9D3A3581F0FCD5C3284FB150D7A5646E73DEB6CD92407EC1D5525AEE8EC6D9F83C795610B069ED62031CA6265FFD8222C27FF037B5
Malicious:	false
Preview:	.z..d.l..:5Q..v....#.J..7"1.w.......b..Sk.-......}.B.CX.^..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{cf284366-6743-49d6-a2bd-r..8.6..{4..Se`.....rG....=q2./Z......f...b.....I...J.\|....]..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/S.....L..c.n..w:....hKC../5-6./...\...S4.Qq.-.....B.P.RVW..:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Access2021VL_MAK_AE"]<8...5.l.4 Q..6q....s.I.!?'a.8.........z0.s..\|...0....E._..rtyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org8.k.1..4=O..,......R~d.62'.t.......Pb.]g.&..C...`...rLHJ.BcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWM...o.8..>br.>.{.....Drm..8...........Y

C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25765
Entropy (8bit):	6.667028024298662
Encrypted:	false
SSDEEP:	384:+XrIym4XPruj9RCNuvrUo0BmQePDRo7b6ZYyy2ZqP2EWDir46sbJrkgKqx:ZiEfSWUo0eiytYSZrHt
MD5:	7B9E86A4FC8058EFB0AD3623A49DE175
SHA1:	8EF2A9E4B977B7099E6046F2726716EF080EA957
SHA-256:	C00AFDFFCC7360859D094364A14B2C8F05413E0530D8BDF3D208F4908151230D
SHA-512:	5760D12AA8306F89E273E24619D277503680488C8A7C06EB6527D9ECD2BC0DC556F9F90BD188B7CEC4C8C68421E08727BCB5E63C269D8BCC26347CEAA4B01B1A
Malicious:	false
Preview:	.x...p......"....>...1V.......,....q.d.".A..b%K8.72-..5S.+..$..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8211df8c-62ae-6afc-d5f7-980843667d58}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xt....e.S....k....&..o#...L.^.. ....q...R....f@%.!~h./T.c..&...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeDFC79B08-1388-44E8-8CBE-4E4E4+....;.N.7.......o...z+G....S..+....(.z.p.R..B".j.>(2..?..i..`..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/Xk...\.A.U..m....u...l1K....P..e..s.1.2.Z..d5A0.\|q:...r.v...*./TM/v2" value="Office16AccessR_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www.mick....\|........ .Q..[]..^.Q..+.....2."....$5Bl. {:../Y.e.k..licyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-16,....8.\.%..`....&...arJ....Q..+...?...

C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11913
Entropy (8bit):	7.097547554671266
Encrypted:	false
SSDEEP:	192:9PWp7VAYkd/e0zk7dbTAJzHdjN9kj7+/DeBR8/OzTYskB7N1Nm5:9PWmvUdYNdBKgy+KTYsupm5
MD5:	23C82887B819CE3E3C10208CAA486483
SHA1:	8493B175A82E1FAA616122E1FCB8292236AA5705
SHA-256:	5B7ACFA84F6CC309114021ED7FFC8E8EEF659A7F5283C40AEF6FDD8D1999F8CA
SHA-512:	21E8BC45B43C8A5816828F1DA47F39DCF791EEA7155CE0D6913AB33575E4D4CFB7757615FE60920E515C54A67B1ECADD7E9EDD9127D7427C4A7CAEF7655E4082
Malicious:	false
Preview:	.......L.U}.N...O.y.C..2HP.Js<..8..C.y.W..4(...h..9..+..]?.!rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{24589c41-e2d0-428c-8743-y...M..F..*.@.....&.I..j.F.@ ?..w...S.}....Umz...A.....X..I<.us:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..1.s..l..L..._L.:....;C..H\|;...\|...AT(..\|..8%..%..4..h...#.oitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16AccessR_Grace"]</r:anXml....N..I.M&...........%.U.\[>..,.....e..@...u..}..&.....^".~ssor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000/09b...O..G..&.o..6.......i.~.Jo>...!....9S$..Z.^/....t..b..h..Z5.cP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI449+..N.L..C.nK.{..?!...1....I.x#+......#y

C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10955
Entropy (8bit):	7.126803799324675
Encrypted:	false
SSDEEP:	192:/iZ3vbai58AyAUDndc1iGoZhfX4fYphZXhII2zaYJHYm6I:4Wi5CAgndKyOYphZRIIJY2pI
MD5:	26B1A0081CEA67C9021259DA73F7AF9B
SHA1:	79455F04E99F80EA628BE5E6044A9CF0133D8F49
SHA-256:	7CB74594F5B3658A0FCF14016B7C36A7CB061DC7295A5D010E31F7529F2C6E24
SHA-512:	E6832931DE528147A52930A1DE9F605F1DEA06D817B39BCC4D6A9AA05E913AEEA4F45C93E387078313BB54F596287E007F051299E2468136EE679A50C54DBEFF
Malicious:	false
Preview:	.y.1K.(.p.......:.X..z.q.._.\.U/)?l..c.@^.5...VR....`=...G.9...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{53007597-f137-4188-af4f-g..i..p.b.....a.jI...+.)..U._..jf&z..s.DPJb.......A..>...-...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..9",...b..U.sT9...P1.x...].[..-m}..#....;E..y^....wr. .].<../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll &..C.. .r...../.%.U.Vb.{..W...Rf92B..%..\F ...SX....k....Z.-...s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b6.@\..}.`....18(k...:.`..~.\|.:C..d..j.?6C.N...O....v0.H.p.,...PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4..6=..#.........PS>....d.....s..>.z^..r.

C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11906
Entropy (8bit):	7.122611504376089
Encrypted:	false
SSDEEP:	192:DoTByxBVvfDehfGeMMgb5wtE73HvgAQtrQw4MdTX7:sTBy3VSf6OQXXQVtnd3
MD5:	D9FE66693C106FAF7F5A092E407675D2
SHA1:	3CCBB80304CAFE2E4F186B7625C4D347C8DD5563
SHA-256:	0532B70E84A1EBAE001ABECAB6D687421282D3544098348D5463C6835D9380DD
SHA-512:	81CB46AAE088B1B93F74CE88E5F25A61DC11538A5E8B06B2372482FE8FABE174831BD0F177C05BE56A5DDB93B677DAFE986EFA56C08CEB4B09BF6BA0A12749F7
Malicious:	false
Preview:	I.U. ....F.!...[.<D.9o.....f\.....@.fUM..E..s.D.......C...s..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{67ae12fe-a546-4c8b-bce8-.a.\|......./H...Nc..h7T....5_.._.V...hQC..LBZ!Nx..c..M.0..p..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/....G...w)}...X..P.r;..(.i[...T....6.......~.O...........o..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16AccessR_OEM_Perp"]</r:an.4..g....J.<T....k..Z#.....i].....P...8.......y....<.......d..ssessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000.i..g....DGpT..5cF..M....Y.B].........o.)..(7.~RX../..V.W...D..drxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI4.`..m.....@&.9..#oO9.C.+..=.u......R...6

C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20250
Entropy (8bit):	7.203959626449232
Encrypted:	false
SSDEEP:	384:nB4rO2nUaxSywZS41upLRMkDaFZD96Mkdc7ZdpWi:nB4JPxLMSMRLB6MkqbWi
MD5:	6625857611A99557227B5D140F235BF6
SHA1:	C0EE26E554109D1B70874E62CC84ABE4F987016E
SHA-256:	E3429EA8A3D54F32A3ECD29D0FC964E85D3EC14C9CA7D588A2E2386068D93D8F
SHA-512:	6CA9871B18A566DEE3726CD87DD914B6D5CEB8FF1A4D17775C92DCC63822A61D696E09895D4ABF59087402DBF90A5FEB62741DEEA2D911DAA21A2B040C7A9598
Malicious:	false
Preview:	.D......e......81....K...hhv............6.HX/>.y'wm....o`@...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c65476cb-94aa-4f81-b485-...H.L.t......aA...[..K.ub%.....YW....t....}v.O..L..5-T-..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/7...t.2(w...^..t2....A....Hjy.......i\|....hX/>.y'.7....~n.\|.:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16AccessR_OEM_Perp"]</r:...@!..7......h0....G....90mM......F....)..P<+.n`.#..x}I2..Possessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/20C...K..).....h0....M....ri!K.....O.....3..Gf.1.;0~.....m9u...lkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSO:...&.V..5.....?k...{S..WkED....FD..

C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10947
Entropy (8bit):	7.136860575495942
Encrypted:	false
SSDEEP:	192:ZIonTk7ZwUlHSnkjg6QggGY0YvVCRcmQY0T1f1L4VVN0vB0ajzp:ZIbCUSnkj3BY0WVCLQYaR1Lk0pTx
MD5:	6A80D55B76108D069D45D23C2918A0AA
SHA1:	B3CAEA4D29E78DB103937183466199A7A228E2A7
SHA-256:	9B2C2C5779829F6CD342FFC0514790EC8A6035058C6900E8F77B26BAD9C00B0B
SHA-512:	F720BFA4B1ABF31E6AE10522E0360DAF6ADFAD8A7A3CD2F4055917E3F478E6F6EC0953A7F97510B8F3151A700CA4807D125B01ADAE9D4B54907A99005056CED9
Malicious:	false
Preview:	.;vU.K.-'...p...\qK....,.8A.....W+Vi.r../.V.....Gq..;.Mpi...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{15e1aa63-7c40-4e42-aadf-%......y1I..~.I..?......:.2......tFg.\|..&......-P..e.=}...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/U.F.A7.5^..,.[._o.......q&:N......*f.:.=.{......sf...CWql.../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll g.'.^.\|%...g...CmF.......0.........3.p../.Q....ez..'CP=}...s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bw..8.`B)7D..S...N.=........B.....7+_.....p.t....Jg.sDzG\|..PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4[.Y.y.%QD..a.3.6%-.......k\.......cGy

C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25768
Entropy (8bit):	6.698445407442692
Encrypted:	false
SSDEEP:	384:OcxAtzJ4MznESeu5HCN2vvhrhvgePvlo0dQtp5OybatMnCFGcSqCefQ:utSCESSQdRMH14fQ
MD5:	94C06CE27DA5AC45AEA9E006BEFAF350
SHA1:	ACC73E87FD30CE8B79AD3780E7F4C0A5C0CDC989
SHA-256:	983BDE841C5DBB445662702BB1EDC9C3A3FA75CE3D8033ECD25250FF6DBA8624
SHA-512:	4DC6CDB91DB1A42811A94FD1EB31230CB8EB396E547DF7DE6B47E2C3348E6F240C7F99627060298D5E14251C9EC2E3856C315CC1ADB94D608EB60D777B3D0F19
Malicious:	false
Preview:	x8.S.E.._...Y..e....N....u.!x....f..?..\|.5.W...L5...lW..^..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{5fc22cd6-693f-490d-882f-3f1b8b6f5668}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..4.V.P.\...F..}...Z\.KI.!.u/.......O.f.:.J...z...&...\...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeBFA358B0-98F1-4125-842E-585FA..j.^....y+...U..4...OT....t.sm.....`.m..6.2F....S-...-......15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X....C.e...M..R......YN....b.mw......)../..%.%._...[5S.....f./TM/v2" value="Office16AccessR_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www.mi..5...\..F....{Y.5....=.^..3.sl......,..x..v..y.U..]7.../...G..olicyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-1..o......-....Y.+..Q...2.e.sl......=..

C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11459
Entropy (8bit):	7.039850471555341
Encrypted:	false
SSDEEP:	192:VC1lg9kZqaZCcdM0BQbSmsF0mgokr+xK8K:A1iuZ7DxQbSRKjokr+M8K
MD5:	F709DA3BF00DEF2EE9A091E4CDD85A1A
SHA1:	AB2FF6F9CDB24DA5F6E6B4238F45D9C352126725
SHA-256:	A119A6F7DD4FF16F5032D50F0B47A388AF045556F04FFB160CCCADEF83A1EF45
SHA-512:	8E6C7D31D6E8B4A47F4CD3E1B3077F86A62992E5333C9ED3812AC05CA2AF72595F305B915117CD44C7B67D261CDF5EF826CC6BEBB0A4349EB126DF5B9C4C6EC3
Malicious:	false
Preview:	...9J ...}q.x.p....G.Y.........?\.C_..T7Q&..9.0.+.'vcj...}T>F0rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{17845bd1-5dfd-4d65-93f4-.R..`Wx.W.!2.3.f..[.M..O.........pE.....P9.q.G`Ex...MWT2...0@=Yds:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com//7v.^@....LN.g.<..G......H.......{..>....xK(..p8<.=..a,7...\|Q3.6/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ..Ibg_(...qm.x.y.........7...A...%Z.....ym ..mV!.5."e.z....Y$\dgPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200[J..)J .P.qd.3."..t.../....^.0...&].P....Q...5.@z....vks...\Odw{rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV.UK_~E..E.\n.k.y..b....5...T.........).

C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	6789
Entropy (8bit):	7.177566119008158
Encrypted:	false
SSDEEP:	96:BAtmm3Rs76cx6Cq3z5zd9xUpiD/rOi6PFOD/V667BoE4c5PlrAaIf8NU:BAtR60CypxTD/rE0z54+0f8NU
MD5:	0C3E070FFFDC8C37E10D3A5F7167B203
SHA1:	CC2A5AE270689E26442E317643488B2DE04E6B88
SHA-256:	514666DF5079B7031D50B2BF3BDB53729539F346DDE254FE05E2956F577D0FEB
SHA-512:	682C521FD31D2E727B1800CD66D61B8EFD50AB74320EEA61472A3819F0DBC40A3A12428F2A0A62C368C2FFBA805CF6BA289A3638B3E794E20C7FC58986676E8F
Malicious:	false
Preview:	...........X.h.z).7...:'..p....G....M_...#...J/.+...NYg.8.?_:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b840d7b0-9b20-c752-2b5b-834600627ab0}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xE..........G.2.&w.r...kx^.$....m....=0...'....9.nJ..I./.5.:F.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office22E6B96C-1011-4CD5-8B35-3C8FB..T.......T.;..;.g..-$..".....OM....Y.S....J&.4.....%.\|X.T15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/XZ.........H..S.!.$i.q..5&..<.[........]..@.%...Md.<.B.o.:.h$../TM/v2" value="Office19AccessRuntime2019R_PrepidBypass"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:[._......E.....<.9h.z...:'..Z.b..lu...?L...t...:.:...I.+.*Yq.sl:priority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4..Z.......G.....d.~2.W...k{,. .....I...

C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11828
Entropy (8bit):	7.113743630501496
Encrypted:	false
SSDEEP:	192:+oHZ4be7pSBrneWMnhNkHhKnksCaf81aMeE48zNOrgUEP5SYx:+oGbqYtnLChNGhKksCayaMeE48BdPQYx
MD5:	0E91CEA4A71C2A75BBF529A135A8CB05
SHA1:	272F854F8D7348FD4F9E0EB86CC786FC657FE57D
SHA-256:	1A264FE6D5F58308BE2C80AED6DEE4A56941CBE16B64B24F5FB3C0D8A19FECD3
SHA-512:	0BEFFCA0B2552EF3564E8EDD88D3E89714D9E62E04DEFAC0257132D3FB1861E59F8771FF690C53ABB5DD490BE770EC99190E060C34D9C2AD38F9794FE4FB2540
Malicious:	false
Preview:	siwQw.....U.V.sveDz....\.#..\B....PR....d\..{]i.pc........XLhrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d56a44ec-6934-463c-afa1-...}.....V...Ge&+.'......>..K...........&...".!.FJ..(.....[S<s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..B......d..IU?u{.n....W....X...B(&..C.6w..wP..#.......WD.&itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19AccessRuntime2019R_Prepi....)........^.E&+0,....A.#........<.....,]..SR`.ug........FV6"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://.C?.......W2{~Z,....[.o...i,....+...I.*v..gRy.=j..F....7\QcrN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0q..?$....j.vS)rl7&..........}:...Z%).

C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	6705
Entropy (8bit):	7.1579365058045585
Encrypted:	false
SSDEEP:	96:obam3McOhOV5xq6BDJvev7d9UpBQuUia5xX46xz/Smyo+UgDW13G7Vnan:obnMRhOV5UGDJ056AioyouQ+nk
MD5:	A8BF755D3BA976709D36907CC890DE13
SHA1:	17D66760192CF4C65EEBC07CF685D4FB863F7231
SHA-256:	EC514370E202D35DCCC7BAC430CBEC47DF1C4959268CBAF565F66AD10A736B42
SHA-512:	96748569C423FBFE5D152B0B569E6FAF067857F56A9E06C9241F224566DF60F4CFB9F2ADF5E8869BB82C89BA1D612F0462067CFE2661C5E560B94B5BD47152D9
Malicious:	false
Preview:	.s.."...ii...DL6.j..w..E.q.b..).0.fx.O,....2c..H.].........:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{696632fd-b654-6684-8c53-f13a60c914a6}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x@..'..Qkj....[Gl.6..2....%.6..&...f.h]\.....=h.^..B.........microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office9D9FAF9E-D345-4B49-AFCE-68CB0l...^.'L.O...HGe.>..'...R.p.0..l.%.?~..~.....58..A.B...Q....15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X_...2.)C?-...OK..4..1..J.f......~.d7G.<....."i....J..7=..../TM/v2" value="Office16AccessRuntimeR_PrepidBypass"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="E..'.K.>h..YMx.=.6...b.X.T..G.k..oFB0....!t.._.Q..A_.......riority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-884..Y.I..\.....?.m..g.....)....{.(.(9y.

C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11808
Entropy (8bit):	7.033982354692795
Encrypted:	false
SSDEEP:	192:rrp1hnOiBSYPOCjH0dalt3mR5LkJUIJ5CohUcOPPZTJmR:rrpfO2PTjHLt2RWyA5CoacyQR
MD5:	D1AB9694C2DB8DEF2428F0809EA7B6B1
SHA1:	65104E192F5975A6A2FE63ADF1112AB965F07285
SHA-256:	4DB9C157F96F9467CF7BC7BCF27C1932119C0A26F92AD3E0F828BFCF8F74E62D
SHA-512:	445604878D7F828F6DFAF7ADB0E9CA7513D379638FD3BDC83B3134B2EAB1D4AF4CCB823113CD4AD13E17603EDA4159451C094BD408C26F0B29BA8C0FDECF7729
Malicious:	false
Preview:	.6..^..l..BR:...R.s..@0+.Aw..$.>_..4P.g...^Z.b.O.l..)......}<..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{a7cb8b8c-4e42-4c20-ac05-..R.V..al...4.C......B.hg.\}F.3.{...\|..i....S.;...Z....[.`E.i?..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/t...9..Lm.smf.Q..L.g.X.9 .au.. .<.R.L$.7..u..n.Y.?......PN.> ^.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16AccessRuntimeR_PrepidBypQ...<..re.Ix$.&......X.;{..aF.,.]F..%..>...U..}.X.~..f...C..3lX.:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.G.M^..2o...y.L......VCw{.\|@=.&.JK..\|V.....U..5.k.)..3.!.Y..c.U.Iy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQR\..d...S....p.!..!...R"...hV1...Di&.~2."

C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	7652
Entropy (8bit):	7.115979119906719
Encrypted:	false
SSDEEP:	96:zNBm3s9zLDYVdvp8ohPo1VUv7BJgZ/+uX4iYhPqeqZggdpo3oi7/qCrQe:4sRLDZ2A/iPWpWoir/Qe
MD5:	7A040794FFFBBF1F40483855901BED8F
SHA1:	667CD83B4DF58F956FD1967A5F73B393FC47A0EC
SHA-256:	6EAC4998B662ACCFAAF8EC3FF529EBF0769840177F7B639BA171880F6F3D8E63
SHA-512:	65C6D0CF69531476CB36646D8F698DD344E4F6C9792BBE7B5B4B7EC65B7207DDCC5C9CCA6D766BD9788F74AA33A5DA974782DECD62AA258C980F266C7B0C6C40
Malicious:	false
Preview:	.uyEU+..C,.IX..y.<VC'yl.........@3..E.}~...G.0..y..l.n....V:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{992b0bc1-5c75-c396-448a-2d75f0e25a33}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x....P>..A/.U...rp.`..bk8........q..?.....C.;..o..0.v.$.....O.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office67C0FC0C-DEBA-401B-BF8B-9C8AD...LRc..3...g..ry.hD\wc}.......U;..[./x...g.kS.p.g/f./.....]15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.KE....h.....~c.b.:ayq...........z...m/...A.:..2...iF......./TM/v2" value="Office16AccessVL_KMS_Client"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://w....0..5.O...z8._5\]+D..........&....*-...W.g_. .~\|r.=......<sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-B..T[e..W......U5.<D\v53.......&....

C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11933
Entropy (8bit):	7.0562911903073475
Encrypted:	false
SSDEEP:	192:JnV8ymMZRny3hU4YXMp9U7XfE0ZNz2U/P70reEZmC9yG7H:JV86/nyxrY8p9n0XqULmZmuyGL
MD5:	E23318575BD7ABB97598C4CB631D7524
SHA1:	3FDE02D875FCCBA27885B8ECB85FE82AE9345856
SHA-256:	07362234F8651E31A157BB9F3BFF7BEA329EBDF92117243752E96B6564D83A4C
SHA-512:	5BB238FE4D84FD1F1E17A061E1164BD849D014E9EEAD2FD51C6A45EE71E325DF4E331592AFBCADB47CA19196408A1630B0B9A73F0E20389A85B536E3B697E2A6
Malicious:	false
Preview:	`..4....B.V7.)......g,>.".ebi%[m..wR...D...........F...'..... rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{bd7ecc28-d27e-40f4-a0c1-..l>.....A9.f.W..^.6tf.4.o1j2.(^.a...@....\.!.g.O#T.....ts:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.+.'...3P..ik.t......,x7..(gmn!.oUA1*.N........D..A...d..L.Onitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16AccessVL_KMS_Client"]</r..1P......W7.)...._.#c).-.?7ux. .6}...@.............Ww....nyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2.Io'.....W-.e....~..i". .tn9~+ ..}..M;.....>....z..$~..W.7yYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZS.0k<....P.k....i..h.._c..%Ql]q.`2Nh...v

C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9922
Entropy (8bit):	7.122799082121117
Encrypted:	false
SSDEEP:	192:KeWmyPSduac5BcRaYUzdHbHHk+FR/y4HiLdg8ptd+cLcFMl:Kuyt5BcRNCVbXCi8/drcFMl
MD5:	2084BF84C69416BC3E922AD1200186EC
SHA1:	0FB2F5BCEEDA5DC11DBF23509E247E16108802AE
SHA-256:	DF90CDB1BF556FA98F7D0CD944141B1B5C53CC06E2EB4A2C076AAF65F11F28C0
SHA-512:	1564FF3ABAA12584B34A2D166EDDF4A9E219788FA8481AC5771E7FD6638C36460E328F10539EAC429E93DD76BD297F4DF45170EC69A0F7C0B174BFF1832FBA51
Malicious:	false
Preview:	...0....@...5.GB...l....%.r.R)..o8.z...\..._h...l..y...o.i?..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{82165e89-6363-4116-9d34-c"]>...V..;..T....f...3.x\Q>.. !.2...X..H..1..Z..X....5.}<..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.D'#..R...i......(...x.p.U-..+z..........M...q..+....{.fx..r:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16AccessVL_KMS_Client"]m9.6.......4.[_....`....).W.Pp.. .%...B....Rl...~..b....e.u#..ertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.or69X<....Y....[E....`...#.@.P;..&..3.....9..v...H..e...v.\|g..YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr.L9C....K....ga...o......N%~...)6.....

C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26490
Entropy (8bit):	6.695516392162313
Encrypted:	false
SSDEEP:	384:gHcNJsGx3pIUntnyP556b8ICiN2XYt0bxPcIu7htAbOjV7aupkSEfAf3i7Z8ueKG:jH3VC9I7LfkOZByf17c
MD5:	8629EA961D72E604E5A5F26D39D06E3C
SHA1:	9932BBE86C52D5D7245565B2281CA5C5D2B4C1EA
SHA-256:	F9C391C9C8F13221D5EBBC9B78BB1B64C7CD5DBC4346FD9634B322227D7384E0
SHA-512:	30ADF598E3FA59B31B5A7A16C4A91A413EC69F7A454C3340B4CBD11BE5625A6BC95C6B505C9C25709622C269EF6A1C538C9E52433E99D8F681EC7BDB350A6C4F
Malicious:	false
Preview:	.qw....7.3...U......r...Os{...l..{%W1.6.-......s\....<.....:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b5939b2d-8dd5-b2f2-c0bf-f2c9c16e8bb2}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.......f.0...J...B.V7.V..,/P...c8*Q%"K.F.}.......?.....v......microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office861343B3-3190-494C-A76E-A9215.....BA{.....Y...J.."...Xpz]..)..s\|Q/.d.>......iC...J}.Q....15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.....#8t.w....^...@.z4...@rl^...:.U2'.d.&.6.......0K.A.&K.o../TM/v2" value="Office16HomeStudentR_Trial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://ww..F..(.#...W..b.k".+..OSL...pV.q2.a.g.6..... H....i.^...sl:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-442E-82.....1@b............@<...@u\|....pV.q2.\|.

C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11939
Entropy (8bit):	7.103677359587532
Encrypted:	false
SSDEEP:	192:9oaXzFXU9R+Ydvo5+Bz+P5Ub628jXJwtRl/3VvjyhaBr5F:9oaX1kvS+Be5UbWVi/3Rjyhurb
MD5:	71B320675BA3353F64852614D296161B
SHA1:	9009CADDD018ECA08124998A9C32CF36E985B371
SHA-256:	C616D3A896290DC14AFC2BC2FB4CAC58014F8F3ABFE2712D712139EB99C8E611
SHA-512:	7A7663D7EA7D1601A623AA4F4E89261016CF60F3A9865C21B07BD392132892EAD0959120683CD565F56AB0D5D9B17B731F7382E47F4A8E9E9A5738B8A64A63D0
Malicious:	false
Preview:	.~.!2...u..+..Z.....V.y..2.........y"........j.>1.&.=..EH...:.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{9eec1f7c-72ab-40b8-83dd-E.H.8...7..;........\.!..$.......Z.oj.....^N.<..v........6....%+s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/7.72U...gE..Z..M.....-..o.......Q.?Z..._.N2.e.(:.k.:......M.s1itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16HomeStudentR_Trial2"]</rI..E`...%....Z.....\.6..=........sc.A.B....;..+/.'.q....B...;1yPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2C.J2=...8.....M...'.<..0...Z....sz...q.X..n..5.r........V..&YlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZS<.N)4..g;..8.w"...+.......>..6.fk.C.

C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26621
Entropy (8bit):	6.606036168222283
Encrypted:	false
SSDEEP:	384:TMEsAnKlesmIJsGhd4pC64Ja4i2joKJ6eC57QuCHWnFroR6Vf0Cn3WLCtzxYWuJ3:JTKIYd4Ig4iGwbtwhWAhJ
MD5:	51AD6CB03A0D68FD96346AFAD16479DE
SHA1:	BC4CD461A672CF74605A7A8E03AE635710087CC6
SHA-256:	473BC95A713D0FBF695D32DDCD9887706CDBE1E084C98120F2C314A03C7C7196
SHA-512:	F7AC701B5FC07ACC80E5B6493D4D52A67E6CE45B7800C191CDE09ADAECAB03A76C66864F80AABE219CEE308CEDF1C7A2E78925EB597E9E97D11A4D6814B1C1CA
Malicious:	false
Preview:	=..rqp..>'.....0A.4v.U.&.J...Z.`.~.P.4.;7Zj....ZbJb&k,....2..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f7100b60-147c-6ac6-9e1c-98eec0307ce7}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x...=te...);g...L(.[a3...w.....V.G(T.%{&oTg@~....L..-"q+R...0...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeA9833863-A86B-4DEA-A034-7FDEB..@\|y>....u....Ea..+&.D.1.K...].g.v.V.xM=$.v..S.SxUz#aaY..Zv.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..:\|a\...yka..._{.EM0.H.).].....eW7..T\|.j,.t.....!]beA.o..N.../TM/v2" value="Office16HomeStudentVNextR_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http.Y99.....):.....q.F+..}...c...4.:..V.xM=5.o.....p.?v,N..N..ity><sl:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-44..[v\|8.....`d...+1.&j...6......l$v.V.x

C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11963
Entropy (8bit):	7.0544285502869934
Encrypted:	false
SSDEEP:	192:FPA7TDT620+JoN/cPkF7wXzKVxBsXnA9Y:FPWD6x+Joist+znXP
MD5:	7A179BEF5A0DF5CCF3D9164DCFBAC05A
SHA1:	5DB4C33E71FC6479D7ECCE6DD3996EDD6B03C37B
SHA-256:	292E71EA5A7FD2AE4D8C21BEF5F177FF7F3E57CEB23124E115067C7A3BA433C3
SHA-512:	9C7DDCD90F2F690BC732BCCC3606FB446992EA7902D4425965C4D7B44E2B32395205A84EF4C78E48ABD2039534E385A52DF59DE2652D4EB79FFA665592927063
Malicious:	false
Preview:	G..9.l]4.c.r.v.+.6c...1..5.Tln...%o......&l.Fu4.A..6.....\.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e8262d82-be60-41f7-a1bd-..B2.&.l.s.1.=.=...ki...}..?.W{6....mu........>^zC..`.O..F.C.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.16.f}..:.M.i.g.."'...:..7.Sh6...]^mU....*a.M&y.F../.Z....itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16HomeStudentVNextR_Grace"._Tw.u^..y.x.m.6...vm...e..#.Vgm...g`.V.......b..$0.C..d.....].pertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.o..T7.$.w.,.x.s.6..:m.....(.[g&...gv8V......yx+@e..Y.S4.....4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExU.4!V.].l.>.r.N.....U......i.yI....'DtC

C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10987
Entropy (8bit):	7.13399847533024
Encrypted:	false
SSDEEP:	192:HViywZu7iFIgymWVqEhbFJ0gis+f1pmXDG+74QIzI/wY:HEy2N3txEFjbN+3cDG6n
MD5:	BAB16F50BAEA864F50B020487A01A41B
SHA1:	B676F8010E18CDF3EF5AB2120EA7FA4017B409FD
SHA-256:	B941FCF2E01A673DBA1F409CAB07EF3903DBA76F0ED42F5B9083C6A609FF3752
SHA-512:	88F3F7F8B4D14EF6F52A48BCB687793806AEA02E69B36FB19217A21F4291F8545C801AC17BD72F98986A5A5DC3CD6C0F3C72508AE49B384514027FEE9D820552
Malicious:	false
Preview:	.=.ZX.x..NG....n......!9...X.x..:....l.b...8.C.....t4...0..u.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{a41f6e10-e9dc-4b78-8292-....TK'.ZGZ..Tx..A...ya..R.{...P..\|.f...1....,"..Cl.]Z}..j.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/l..I?.X...v ..F"..]..u0..9Z....8[...,.5...l........;i.{.1.././r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ^..(..p..ZK....g.....g3...P...s........8.D..U%..M .{.}..j.s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bN.7.,-....:...N..h...`(...y.X..V....e.....g.a.......yq.\|7...w.PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4b..V.5s...M*...b..x..9,.....WI.+ ...}.

C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26679
Entropy (8bit):	6.720007122905981
Encrypted:	false
SSDEEP:	384:/7cVis2FdJTb3FAf7XLZ6oENuHymzAKWomqhPc6uaY+42kPSO6Quw0GbfqrKFPNq:/pzTb67V8rtVrq7wruTGOuxi+Zg
MD5:	A1FE92620E12424F46EB8BEB55E16A77
SHA1:	09DA23304FFE6FF1FECCC76CE390AE31DB596725
SHA-256:	FE8CFFF21830E0BF758166747ADF359BA3048F5B0C947751E47A707D2C85C236
SHA-512:	BDBDB487193E3D76FAE7B00FF73BF6F7A7CA61B2937B24F17102859EF17B6349A1E2A6B22AB4F3CFE944040C31498F2025CD996F1672D0BF0D60F0C4220750D6
Malicious:	false
Preview:	%H...3.........L.Eh.....R..n.'..O.)G.f.....Q....C..U>......._:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f32a9124-3209-1533-b7f7-ae3a2611f529}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..K@.&;........G_]4[L.....:..p..h..G..t.k..U...\U@..:..OX...F.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeE2127526-B60C-43E0-BED1-3C9DC...r.}{.......GV.<.....U..o..2..H.!..*.....q...J..M;.DR....T15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..i............KL.6E`...Q..y..(T.J.`E....U..W.....O.U}..rM...../TM/v2" value="Office16HomeStudentVNextR_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="htt.....<4......DLI:DD...q..x..r..v.9X.e.T...Q...._...b..L.....^rity><sl:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-4..`..ys......Z.a.R`j.......f../L.Y.....e

C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11948
Entropy (8bit):	7.054446141481731
Encrypted:	false
SSDEEP:	192:x4BVyWgdq5kJpqv6j+/eawAPY8XbnwR3BZZczbuG8w:x4PyWqqssSj6iAPY8Lnc6l
MD5:	CDEB79EDA0CB939A791AB5435156F7BE
SHA1:	171E384450EF7A6A5BEEAFCEE81C6859DE06014F
SHA-256:	D8473860F7517028300EC1750C63EE0AC944186FEB1604A46BA3E4AF8C8F6673
SHA-512:	27C7C8174F231880659FE70A2A4E2BFC024FB5E64B0C53FB2A301D39F6A1985F94338E49A165C5120A423A987B912F19D74660C1E93CFE2C5198F9D7EFC04880
Malicious:	false
Preview:	......bp.).f...;..S.%O.../.....2......\|M.9G..8......aB.j...&brg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{5f4c5fed-eaa2-46d1-85e9-.bo]..n/.h.r.J.-..../..A.9....Iw....A.rI.{..UaN....d@uDT....96s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.TC...BP.p.Y...w....a....r;...I0.K..j.,..kl..4...}..fO.s....o,itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16HomeStudentVNextR_Retail.[2..nr.2.Q...0....{S.S.v....@.....I....kV......`.(c].~....%*opertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3..ti...?,.o.;...1....7S....?...@e.C..I.6..8...8I..5..\G.+.....,nz4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlEx.tYf..F(.f.V.Z.2....X>.:..6....n@.'....z

C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20292
Entropy (8bit):	7.239242965442185
Encrypted:	false
SSDEEP:	384:vTKXqiS5jDyywbFmXgS1AOqRv3zkZAyiAKLRM+TKVJD/:v35yywbFek4qyiA0R0D/
MD5:	B0B2D46A363B72A6C3B2F6BA8C525A5C
SHA1:	A8A33A47642592B6DAB05E97891236FAE2ADA994
SHA-256:	28D7652FFCBC520C93FA44EF614F6CE3E44561F93089CBB6C9FB7F3EB77023B7
SHA-512:	E0643A256AC0ABE4150BABF755D7B760A9D472B8E3F99EF6FC7CE81AEDCCA00A5A54E76BF50DF83C256FE9B5403B94EE559A7A3200D4F79FC2B3E22F26851B35
Malicious:	false
Preview:	...v..R.....t.....;.w..J.......Az21S.......>.]..h.M.P.f.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{485674f0-4853-4c74-85b3-f).)M......Q;.....j./C.W.Q...\....%"?W..Y....Z...7.'0">...y.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.C.ew.r.....Y.).....p.~..j........9.0~..........>.:./h...^..:.:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16HomeStudentVNextR_Reta6}....M......6c.....v.,].W.....W...xva........9. .'..m......g.propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.wl?.8H......O\c.....:.,].v. ...Z..R~]a.........:.r.(R...O..t.y6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRl.i.8x.l....]1i.....[.AR.`.)...x...6qj!

C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11499
Entropy (8bit):	7.071017407477151
Encrypted:	false
SSDEEP:	192:1CxXZz7yYkFLqCebdSCSvw26QKoHqPJ4wSQHJuMQqd2t:cxJz7ZkF5ebwNeoHqR4wSQH8XqAt
MD5:	9B2D087B67A61F145BD528C189EB4A41
SHA1:	9FBEF009827A815225B79D0E6E22C83C5A5356F3
SHA-256:	DBBA9EB88659678F522F0824D7787FB695AFAAAA590196CBE3C9556CAC3AD2B9
SHA-512:	8D5761F612EAAD9B6D60536F6C446DB0FDEF515124C72AFF3CE3748941CC3C842757E5404A3C0A2AD7B9540BA11C809A74A4FF09EA2E2E30F66A0EA0C3F646E1
Malicious:	false
Preview:	..Vg8.VK.t..9....y..>.....f..0...k'.F......~.[Y.'....l9N.&LP.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d257c817-9677-4a4a-a4f7-...o6....;.7...\7..4.....{.O3h...}o.V...M..(...e..y.=RRJ..2OO.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...t_.vk.-..e....g..z.....F..7{....-Z...@...u..WT.,'.EWLlT.#A../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ...f.^..`.......e..\|....e.Kbj....Lf.D.A3..w..J^.'....x_Z.+VJ.gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200...b(.VK.q..i...c...k.....l.I.w...~4....iN..Z...b.6<...XhE.=.a.rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV.(..~R.0.......p..y....@..5A....tk.T.

C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26728
Entropy (8bit):	6.67848443941615
Encrypted:	false
SSDEEP:	384:I2K9sX8QtKt4e1XfxdEfhICN6HDqcCePygcF3N7+baPG9YFGgUJGvHU5E4:epct5qSjcE97zTGes5R
MD5:	84CCADF91F7BFCAFCD2F41F310E666C1
SHA1:	587E9943CE79932D7DA677664D3F60996FC7C441
SHA-256:	4D601CD2BCE582D8E6EC8E5305CA329923A52483068B1801244B1C301C136A5E
SHA-512:	86F81CA3E9DD1BB9A7137F90712553D1EC7AD37AF697F1D0D881C22D45ED1E940940EC3992955E16D1A4173E80C9D5C34D1F264A8A4F31A0256CFA820C5C5E24
Malicious:	false
Preview:	_j.%{..i._O..b.W.....(.V.@.J..Ar.z......_&....Q...5CB-%0...8.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{df50a70b-99cb-733a-04fa-78e62afdf405}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.[j~..8.\X.}....T..:.........NU.P....o..<....LM..p.F7"zI..=..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office8BDA5AA2-F2DB-4124-A513-7BE79...\p.%.yn..n.......2.Q.C......u.r..DM.Ll........[G'hqC..S).15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.y+k........i...J..(.U.A......w.3...@..D.....Y..."C...G\../../TM/v2" value="Office16HomeStudentVNextR_Trial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http...n3..h.JX..k.D.I..Z...].o../(.....DM.]n....K...}..l%fI...%.ity><sl:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-44...!v.(..l...N._.....9...C.S...~.r..D

C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11960
Entropy (8bit):	7.0771939223664795
Encrypted:	false
SSDEEP:	192:DphDo2f1ho6OZ9CZFTg0Kf1tDmVR70wbDlJbmMDEdBKUN:Fpo2f1G59CZdg0W19mVz7DEdBBN
MD5:	1C0F1A07DC1BB3354F30890D67860595
SHA1:	A28A51B6D8AE86DCFFA3A7BBAA7AD9DB6CFC0EF1
SHA-256:	7C98DA30CEE5047304F377A2B3DA026C2668474552D98E89D3A7E552C59C635E
SHA-512:	7BE8616823A97126E6E43F60D77855704913A59D4B436DD46CCAB0AC757D4D9F37AF4FEF57169DC6B69E685BABA636565D98759685CB252BE9B164D18D38A071
Malicious:	false
Preview:	.....;n%.S?W......4....J..e.^.j...j_m.s.\|.fW..kD......O...Nx.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{a0836ec2-ff82-42ff-bbd2-&;q..z`z..c........>W.X.\..6.I./0..".}.w.>.o..W#x...R.<..Mg.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.....1N....h......pM......j.Z.h;..+o."...5X..}O..........R1.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16HomeStudentVNextR_Trial".cl.."m._I.].......:....O..M.U.tx..(...!.x..u..k.......Q...Py.pertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.o78l.s3f..u]......:..6.b..Z.U.-4..(.:.8.0..R..VB....N.!..Y=.4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExU7.....7}...W......W.. .k..T%{./P..h1v.

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	31085
Entropy (8bit):	6.753769219462612
Encrypted:	false
SSDEEP:	384:LkaKxCQs0aPQghG04/dmNjy9Wyuw/l648ZUN/aRjPiS1Pc5puwheAmMA/pN9YwcY:HQb04/w49X/hPzmrSL1OaOKqaA
MD5:	EDA69C61FA1B0F7CB96DA82D87B72D00
SHA1:	081DEDBBB32423D9212DFDE89E93830A38183A72
SHA-256:	2ACED592B832833C216B905F791C2613C8B9F63BE67C7F151212CDA04B43676A
SHA-512:	6C8385851E4538828770FDBA0BAE4A5824EB70715FACDECECD3EFA2C4F916996E8ABF62BF22E6A7F4449A6149513D1F072B81F8A9FB357BF1B6F2F16A806BB43
Malicious:	false
Preview:	ANq.r.......SA.==..+Xqy<..../,Q../!F...~.b.}s. .oTF.Mq.g.}.b.x:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{3cb4f178-aa53-38a8-38a5-18b6692c54cf}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x...w......._W^.g%.~.c-h.L..{{]....F.....2.iw.+.&B...u.`..o.`.a.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeE7B23B5D-BDB1-495C-B7CE-CC136....A..p..)SM.nl..4.kh;....}9V..:)..,.q.aS.{.o]\.Ut...&.&.s15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X...b'..V...Y_J.tv.R.qd?....c#...ahD..n.y.cu..h...M2.F....Z.$/TM/v2" value="Office16MondoR_BypassTrial180"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:/....c..R....N..or..I7~D .0....C..yyW...0.y.cs.<...V..n....).e.by><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7....{^......S...3]..*F~o>....((.../yW...

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11938
Entropy (8bit):	7.0538559187550955
Encrypted:	false
SSDEEP:	192:0FWmjGXpGYiQKDPXPz8OAdvWhPRUf9Ob3TuBUUq3F/:iWmMOQKDfPz8pIpUfVUJJ
MD5:	354A82C15625B1A80829B80C986EF3F2
SHA1:	6B1E8504F48E9A4B1DC450FE9190FFF49F77AEA9
SHA-256:	5B7C57C03951B69E2DF997BF507860DB04B0804956003393C2E5C939A956FE83
SHA-512:	207BA799223B3E81044FB2272D2C7F10761470620F1DEAE7BC4CF95B4B581D7E6FB6E642E84D9A2FF788C3A645F2CCD5F8E52175B4B67F727BA3D08372B5AE7D
Malicious:	false
Preview:	.....(+.[...#.S..}2.4;.}.....r.'^.vA...q._V..F.gQ~..A0.W.2 .rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e4abc305-c61c-48a1-9096-a....es....-[...3m.>jE%....e.b..`...u......./mH..vh.$].4..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.r."..I......A.cq.ppIt......v.%..09..\ ..}G.J.qZ-..L)..Vcc...itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoR_BypassTrial180"]<wR...+.>...5.O..1=.+k.~.....).?M.b-...9._.O.J. ^}....{..E/>..rtyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.orgw.....v.T...4.U..}=.VJ\|S.....p.9f.t...@q.lX..w.ahB...\...6&z...BcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrW.s...d..9...76q...P.B\pZ......r.6Q.FU..I

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	30082
Entropy (8bit):	6.765451530229907
Encrypted:	false
SSDEEP:	384:esM2S8ajg3EYkhzEXQTenCIu6oFBgimfmv1RNaWGeE5uuYmIkfYSYMbhpojo+wWD:O2SWkhzEgjIie61R0wCYMqj9mItb3
MD5:	8559B408CEA5A497C7ED79C8F70B9313
SHA1:	4B2DCD67FCF10A43C5379E9B461180DF05516BD8
SHA-256:	8869462B61C42D99E6B3548AE24FA4F64DB41CAE49A9E3F720906058306DA049
SHA-512:	9AA07656D2C3E5D8AC309DA98D288A70630CAAE72799CFC9277F54A76FDA8A9D21CDFA984D41AD6F8651261AB70FCDD4A2A2833B1FAE0D36B9558D325F737493
Malicious:	false
Preview:	V..B..W..O(.. ....R..?1-.".`../k<...........&.U...9...JD^...`:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8c4a9766-eaa1-4992-2aee-bdfcae7e59ab}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x......B..L?.$.t..X.z#y.s_4.Uxg3.=........).H..\|......L...y.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office14D002D8-B1ED-4AB4-BE6C-5F3FA...L....li... .t.....o+<.5.a.S:ly...........!K....&........k15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X...L..w.J.o..,.x...F.y10.-.w.M "j.B...........6.]......=.=.;...</TM/v2" value="Office16MondoR_ConsumerSub_Bypass30"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl=".......KNc..*.~...\.~~%..=I.7:.R.W........5.R...5..K.@.L..~riority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-884...<....}z{....$..U../"...^8..$ln......

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11961
Entropy (8bit):	7.0241572734529845
Encrypted:	false
SSDEEP:	96:RbmIp0NgRAm89RimioC86oKUqMTv4StyhD+5ya8vgRARHa/36lqxI0+YFD9M8aA9:17eiXHU5TAS5eY00w0+YnFHdLlvZVh0a
MD5:	B504D2AA15B1A393486EA75206A04F00
SHA1:	CBACD2190CB0401F2950ED03BAE8894BB67FD05E
SHA-256:	60F751AF541333FF699AF89521A0D3D134045DA65CA27E04CE7F667E5EF2EB2A
SHA-512:	32A7F1CD956D8DD9F418193CAD7B45A3A1478CEC61AC45F069D42BB6B8F1D76339F2A41005E8C5446A39EF87B103B08810D19CED2BFA30CA47C768DFD7E8B388
Malicious:	false
Preview:	..........r.=..;..FPb.&kl....Y.OK.....B"...jW>C..).R^...'..~.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{1e3f776d-5faa-48d6-85fb-K.8.......,.\|..+..d....:I0vf...@.EV].G. .L`O..3.v...C.e...j..aOs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/6m.....N2...q..x....k.{Kn...@[N...l.~G.p3..fZ(H..>._G.v..7Uitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoR_ConsumerSub_Bypas..j.....t'l.+..o....iUy+z...W:.W..R.wG....uU)c.....J.....1S:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www...t......*P1..+..n...S%UyV[...\-.WX...\G.%...=X.D..6.^\|..{..<@Iy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQR.z".......K8..!..m...2J8vBM....#<y}.z.k

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	31353
Entropy (8bit):	6.778285302730246
Encrypted:	false
SSDEEP:	384:5uXGf36Ya3gF7WtHuw+4N1DEQoVPa6Crk5OkiuMWeePIDZoif1cYM5u7u24Q/9Bh:LKy6cEPo1v0kwFH4YuYDv
MD5:	6BF9F8F2169FE106FE33D32A950DDE15
SHA1:	C2C89A93E43F01559FDEB7BDBADBFD36ECA43A9F
SHA-256:	C572BF202F177188C57DCF9295ACFFBB84FED7E8B14228DC4DEE4EC5D6780250
SHA-512:	8FED7C3006773FFDC9C1F07BEE204C8EB11B98A1FE8A08EACB1F027E4D29B622FD65CBF8636E2CD45D5CCAB386494E3FF5D34DA238E47C3EE6E9494E79157852
Malicious:	false
Preview:	........t..[.&I.2.......d...:...D...p.i(..i<.7....i.$....:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{34ac524f-8f7e-c5f1-fabd-b945cbd306b0}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xU.{....^.w....9B........I....3..X.....V.~.j.m'.. .r....#.6.....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeAAA4ABAA-369E-4D7D-93E6-4C320yP$....C.R.Dd.*B.c............q..x/........:.I/.Si5.(...O(..J...15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/XJ-Y..L.0.Z..-N.y..........k..zt.....@.).o8..nw. ...#..A^..J/TM/v2" value="Office16MondoR_EnterpriseSub_Bypass30"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl.B}....L.u.... D...........,..G....T...t.s'..h0.=..Oa.)....:priority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8.T ..T.@.'..x..%.....9....,..0>....

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11969
Entropy (8bit):	7.056271642818654
Encrypted:	false
SSDEEP:	192:owS/XtjPkWI1Crgf41MsLSj5UO6vHP3JI7qKMWyu6Ht:fS/ddIkr06zLSj50m7lz96Ht
MD5:	34AD4810E5D66A6F19AD32492696DDCE
SHA1:	25BA0BE4D9AA4FC75C4DF11E5CC7595EA14D3B2D
SHA-256:	FB465865643C6F98C4BFFCCC8F0ED0AE851D1DB1586B98F9BD00F40FD64BCA9D
SHA-512:	0C9AB934A6B02A30831A761026C6B7FDC26A4836F4381B1B714587B026E7DF9659D6EEE505B7BFA01AA76A0BE7C430BF04ADD86F5F2D1C4DAD7B1DC4F498182E
Malicious:	false
Preview:	.!.d,f.).b.....A.XX....1f....`L.b.$....MnQ.I.U...V..}....A...;+rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{2b81ddfa-48c5-41e3-a5b2-..bhqx.}Uq.....WO..H..[i*...]c[.'B=...Cj_.....LFj.........:.$.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...wKl...;8.A....F....W8m....gH.`IfQ...?..b.Z...]..j......m.reitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoR_EnterpriseSub_Byp..'k#<.y.fV....Cg..I..P=g..H\|../.......j..\.U.].Y..[...I.+.j/<r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://ww..#k=q.".&\.^.....W..J3+...5]j.%......Ll .J.U..UT.......v.,.:_1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRs..8.kK..nG#.Z..`.[j..n7J...!Kf..@.2...(

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	31077
Entropy (8bit):	6.7974803368100085
Encrypted:	false
SSDEEP:	384:loQ3AosbfRgkIh6fPI/bcUVbKmXx5T6s4yNWBhOeJc5huFYCKocbaPlXROwIs9MA:lh5TkIhKQ/bN/VPrnaGfFbJ0u+
MD5:	FD06439C85385FDB1183364D7B060959
SHA1:	AA1EAC63A729167092E1F8567FEB29756E13824F
SHA-256:	4C1DD8E7A9FC7EFFCB73BD91FBE044CDE407DF4AF53F6F736A18CDAD8FC56D52
SHA-512:	B11682C4772843B3C9F0DB8A0C6CE1F58546D54942AC0F58F37EDB6B81E91A53F7D7B36C5AA5CBADC8EA13302DCF07A498CAAB4DA28F43925D3D715C8C88CDEF
Malicious:	false
Preview:	..}....;:...aK.Z...I.9...#...}...,.:.N...........A...I.tj...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{337077b0-24f7-cefe-40d2-c81e02509f03}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x^R.2....99..HeT.......+TS.\|........:.4...z...............fg..7.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office8507F630-BEE7-4833-B054-C1CA1r.]x..-.K...>aG..Q.V.#... .h...9.c.P..9...]...Y..B../...%15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/XAs"s..#.m~..Nm@..K..0.9..."...r...b.8.....1........A...>..:.<r/TM/v2" value="Office16MondoR_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www.micr\M.'....vc..?'\|.n...6.[.r... ...7.~.....h........E..BO.%r..,icyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-165..,w.\.Yn.N'W.]R....`,..r... ...1.n...

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11908
Entropy (8bit):	7.067654338693836
Encrypted:	false
SSDEEP:	192:aGh/f5Ew+M7RuX9fmbatcCHDbvjImd2PfpYFQTdaGHy5:awHGmCdmbqcicIsppTdhHo
MD5:	98A29CB8B44AB59B9B34B797AA21D34A
SHA1:	FD9AECEE3CEFE3BB9BD9FEC4F75A2CFB865F50E5
SHA-256:	7C06147E4656EBFD88A69147BB65F7D0164DE96D829D8D29EEAAD0FEFA6F0CAD
SHA-512:	943460A3777EABB69379C9F2F714F2AD3A9B8B8460367F6B8B82CF2F9FA1A261A935687FEF807A4C7123A31CAB7BEFEE3F791B9C3E4DC80D774070A09E83611F
Malicious:	false
Preview:	c..u.....c.....9.3...!.......2n.3t\....0Mq...Kj..O.<..~.M2!.}.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{537e9f81-e6b7-4b91-9cf5-..7y.....2...Z.i.l..yBG....%6.\|mJ....4C3W...8U.y'V...@...5.b.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...f.....R-..H.:.p..u.......66.w6.....a.#+..Gg...C+..g..cb.4.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoR_Grace"]</r:anXmlE..#,....:O....v.n...sE......u%.4N[....o.s...5..L....z.e0>.k.sor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000/09/..=-....:2..1.}.c...?C(.....&m..i...E.Y>i...l8..E]...m.Y4).v.9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI449+B.........5&..8.<.A...[L....../'.,hU..o.

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	12746
Entropy (8bit):	7.09044447991611
Encrypted:	false
SSDEEP:	192:1iJ6duKc1gnADas+aCgxxUzPirUDFujgTU/0RG7Rhfu:1w6HcHus+aCgxGjiUhm7RQ
MD5:	CD4F55B604BDCB0B695D10F0204D66D4
SHA1:	2B10C7A1EE2C3D7B3A221B6DAC930B00CBAF4BB2
SHA-256:	8B33FBA76F1DA8EF56F9257B44C47F5EFFC47EC1519EA1A3950052866AC6171E
SHA-512:	AE3D307D6658601456ECD9D3F35F3691DEFBB85069A8C3180BDA6AB640228E183D4689CC7FEEFB7713A155584FF4B5A2C7BF9DD7855B7E120FDF5CC285780B55
Malicious:	false
Preview:	../..6.G[......^.Jt...U..N(0{....U..P. p.]^.S.7......8.....B:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{2c14eb7f-1575-6d70-b82d-c7a5fff0a46a}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.5...#..Y...D.....*.......\|gw.+..U..B..pj.YQ.NJ!.NK...r.....[.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeE914EA6E-A5FA-4439-A394-A9BB3\`...~Y.+...2.....f...D...z%\|.........3:.}Y...>......y.K.I15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X......-....B.....4...H...d?2....W.....;).[N.[.\|.....O._.../TM/v2" value="Office16MondoR_KMS_Automation"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:/A...#.H..........T...h.....i.K..D..U..;%.]I..Bb.OF...r..B..Xy><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7C...cQ.N...H...P.Yd...C...K/4?....D..U

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11940
Entropy (8bit):	7.000225606470427
Encrypted:	false
SSDEEP:	192:qz4y7LIWlFnul2ziQ5RLquXgUZuxwSRWsnJY:By7EWDlGeRLqunu2HsJY
MD5:	CDCD2F3A6DF884266EA4E02C942C35A1
SHA1:	6409DF560612FBC0145F61C659CB1F2CE9DAAE7B
SHA-256:	7573B45F6C5B939944B65E8ACD9B9D26EF6E3ABACF2F184C1511438D30A6A01B
SHA-512:	0E080B1E4AA4625E7C24103635EF33B03E2D41C1B63E770799246643D94679C17E16862B1075DB86079E9229E2CD5EE97680F474E5A8686FB9E9AE84195E7DCA
Malicious:	false
Preview:	.....1.G,.....:..YU.V....B.{t0VM..(.......'.!kD..T&OtL.t...\.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d5020fe1-54b8-4ddb-9d49-.~(....<..+..DH.j.M._..O..H.xch....`N........x9..9}LnC.......C.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/u.V..........ZS9.QM......@.\|phT..XPe.B_D.t.-fR.\.1HyU..%.N...itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoR_KMS_Automation"]<.;!G..1.I9.....h..KJ.L....J.+/.N^..DE..FG..\|.-5...A.Y9...6..._.rtyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org.{+....d.I$....$..K7.79...G.`v3Hu..pE.^.J..+..`B.3[..iw..E.W...BcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWk.To...v.C{.)%.E.pD#.;0..e.EtWGB..<P.W

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9929
Entropy (8bit):	7.060958394313954
Encrypted:	false
SSDEEP:	96:QkmAu0pgRAZRb2maQgTeXMigFNBX3g4agH83pRxvykP9m6Kxkk64mZVIm3aZsnd2:fuOSagTeX/NZ7ykP9xgYTmz+B3SbQ5e
MD5:	80ABA896705A943537738B9CC01AA63E
SHA1:	CA3FB2A8B9567AFCC6D251CC165AF9EFB3CF2AD2
SHA-256:	5EF87CDA8AE895C74BAC3E2D0539055E355F477C99ACA4ADCA1965461819AE25
SHA-512:	7E69C8E672F8C875C1738ACBC1E1D61C96DC5D52ECF693E5D385955B86BEE8EF985720413FA8F63B121C061ED34BB68C756BAE0D0F87D3E56FED7F55C32D810C
Malicious:	false
Preview:	........T.4hX%'....0...p.........=]kSx.B.J2..+.Uy.....P.xo.!rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{45be9451-9213-421e-ae27-zal.O.....G..'NuiR..Wh.E.m.C...Q...u.{]\|...Cd..c.cP.......ll.us:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.VG.......k.+5.&9N..Md...P........E)i.).E..~..-.Ho.....D.w(L4r:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoR_KMS_AutomationoY6..G....c.-uSkvU..,...y........v.;-....,..#..>.......f;.iopertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3."vm..M.......0kRkl[...,.4.T.....C...].-..C.....9.N.......f.uH.-z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlEx.v]..2.....d.oVQWH_.w#.".].A...f..jJ.U

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	29612
Entropy (8bit):	6.6809969195468835
Encrypted:	false
SSDEEP:	384:uzO6TWWaYgYaOfB4kwWNsPdQCNX6Pq0jPlqePNCISNRPCp6667L4tdoPmhGj/DTU:l0W4aXbWuPdQSX6CGtmL766TXY
MD5:	6F92DA82A0B729C82EFCF7009DDD6973
SHA1:	4F53B957181FFBF83BA55BB7D357A5A82F09A76F
SHA-256:	72EFB74DD8A1912E8DA3965429FA34D107EC6411B89E7DA714A83440ADC98AC8
SHA-512:	78758635CD9712610A61FD2A2F3E29DD573A7A9719094341C98D6FC97DB54EB26011019FF3870731BF0549564DD91980BF4332F5325011152B75DFA1AE14183E
Malicious:	false
Preview:	...=..X.dXJ............gUo..E.u.bE..].g...r..`.M.I....S2W.+:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{79e225d7-39e9-38ab-014e-a8d4a946b18d}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x...r....sD...F..K...K..8.5.I.R.HE.zO..N..}..)..D..... Z.2.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeA7693F85-CCA9-4878-9A32-8BE27H..8......E.u..O.........dT8..B@r.j.....a...3u..`.W.Q.M..i... 15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X...3.....#....U..U......fB;...Sp.+G.U..6....b..g...I..!..W..w/TM/v2" value="Office16MondoR_O16ConsumerPerp_Bypass30"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:..#...D...]N...H..T..@...g\)..5.X.I$..1.t...D-..)...K....=E..jsl:priority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4R..5...v..,hx..[.......J..;s$.D.s.>..N.

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11977
Entropy (8bit):	7.054440479193726
Encrypted:	false
SSDEEP:	192:78xfmqbVflxdbugW0FtrnV7AcM1pDsbFejgDa8fm/GGcEnEtp+g:71ajVWanV7BMrIAgDaMm/bdEH
MD5:	4C4074701E3D268D3F149E8787D2FEBC
SHA1:	884A80F71F6294569C5CEF0361855C824C376B82
SHA-256:	5BBEE773E7F434C48DE1AF39B7A49EFFF88272E2FEBD711D8DEE33148A747B1F
SHA-512:	CEF22A7431690D2323B3BF45257A9ECE0B52B7FF6085796EB25002B83A30C12715640D8394F63EB5A99F0569B4623ADB80B36600507366669235681511019A0F
Malicious:	false
Preview:	...5..o..Z../.#^...9.....%I<..s.&$.F_..`./d...r..v_......i.A\|.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{9779e3a1-8cb4-4762-b250-[C.=..:...K.!.lH.I.d...A.3T6I.+.i=.....d.m3.H. .._5....fQ$.Bc.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.&.&..O...&=s.~....-...xi>..+.bf.>+..1.}O.......;H....VZ8U]5.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoR_O16ConsumerPerp_B...z.2...].f."h.I.o.../I6M..<.5?.*.N.b.ge...}..rj.....Qe._f."><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://...'.,..K]Bl.\|....o.....!.zM.....5.=.N.;.aN...}....Y....].S5Ea.rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0q8..[..z..{(#..x....e...3.%d. .......3$`.

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	30849
Entropy (8bit):	6.761234628873506
Encrypted:	false
SSDEEP:	768:HwO4OYOfRjCXjkMaUC6vL+iJ7YBb3+tZPCj:HF1fRjivNviiJ8b3Bj
MD5:	4F38742236830DA3EE9A0A2225CA3488
SHA1:	A267AFF34352CB46D9773FB75D338378323EF054
SHA-256:	BFA897BC111D38D3B327E443FB6828819B900F4B0F85763339381DC81992BCAC
SHA-512:	C270819EDDA924A924E31F92316DDBF9BDD1D4D2C602B2CD3D527B252F89BC6F48C3332A36EFD953207F4F688ED3039766719FB81BF76962BE2133AA0451194A
Malicious:	false
Preview:	@.$./.{.N-s.j.2....?..s.c=~..........d.N1U....N.....W..x...X:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d321f8d5-99ec-bc11-d0aa-33b39793170c}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.....n.L.d2#.-....a.Da.7l!Y\.Q.........>^.....S..3_.M._0...A.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeB31C9322-8FA5-454D-AC52-100D5....U.#.>.R\|U.>....-.Qi.d}.Q.....Vb...7F....@..e...].T:..S15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X...?.[..i4b%.9......Gs.`2..R..W....+..^`N.....F..<...}.b%..../TM/v2" value="Office16MondoR_O16EnterpriseVL_Bypass30"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:...x.b.Tt9+n.s....~.L5.#=~.@.3n....nn..<"Q....L..-...P.V4.....sl:priority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4....%.".*l;.X.k...$.ae.5l"+M.P.....R3..

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11977
Entropy (8bit):	7.094614160365521
Encrypted:	false
SSDEEP:	192:uxKl5D+ca5tKc5z639vDzNyqigBTmGA+fDvAvyc9UeW:SKftUN5z63JvrighBA+fLAeF
MD5:	4AE08C46EA9A7C1DC4DD845F89DF17EF
SHA1:	AA8E17CF9E3D255F5626DE19F577F3707A34FFEF
SHA-256:	4CB25D25D3A8C95900BB8555CDA5359708787E7BA075F5D081E8ABA19F8F7621
SHA-512:	D402E136736F80E6D0EBBE2A812220836797B303555BAA32EBD6D25D99576AF13B612C4BF2C33829A31D1F4B408C0ED0BE7A9D7A55F5C204476ECEA33786C672
Malicious:	false
Preview:	...6...\.\|..+ZE.".v9...#.x.I..y.U.....r}..."K.-..h..W.....CQrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b05c25cf-3ab0-42c1-90a6-+.!h.....-..`.S[l.+3..Go.e....!..L.....vs..t..e..A.`......\.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/W._%...N.M.4...<.b}...(.X.F..!.......##...-G.;..%..Z........itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoR_O16EnterpriseVL_Bj.sy....!.6..#[s[l. y...>.x..C.6.N....p3..<c.$..l..Y......Y."><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://d.e$......6..r...9. d...$.4Q.C....D....)....W.=..a.........^ZrN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qA.CX....C......+.;..5..U>sL....r...

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	30928
Entropy (8bit):	6.683233051972148
Encrypted:	false
SSDEEP:	384:0Pb7aCgswVL7HYrG0VmNN2JTMdCNK9dDTV1Pc+KRaHqO1UMWQe5fAiJFbUHXqEwB:SnwVgrbmb2puSCVearUXV5ftb6wObE
MD5:	019E409ED82A12A7E3487477F46BA3BB
SHA1:	89C532DBEA8C95EA264C81C9427BF05FFC4A469D
SHA-256:	3C5FE708D7B8BF72EDB3E907140766ACFC9FFCC87585660D84CA471013D1703A
SHA-512:	9816A5F29BE31C05445D13FA10B3BF0E0252B1234E4F44E118430CEBA31E29A3DE35872FA47F90933C257097B83C19374CA44F3F92DB3D6ABC0C7772678E922B
Malicious:	false
Preview:	..0....>...#.`\|0X.JM.`qc...g....YK..K.7.yy.:.h.0.....90..A\|.4=:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{948cc83b-7f80-94d2-dd45-e8e2b1ccd42e}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x......o...?\dc;.....%c7....3....ha.1mG.)c.>.c.y...a.#7..Sq.1$.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeC7136135-DC7F-46C4-9818-EA246.@.....r...q*`p;..._.0kr...5...LC..U3e.j3...3.0...6.3}...8.%615-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.8.....}..oZlw7.....&q~...+.......7'.b .<.b.7........$,..a/TM/v2" value="Office16MondoR_O17EnterpriseVL_Bypass30"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:....[.."...&.~=3.....-7r....M..._`..F.E.}q.mL~.y..,.>7..Nn.z\|sl:priority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4BM........'J%sT.NV..g6.....7....A....)

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11977
Entropy (8bit):	7.083214379068592
Encrypted:	false
SSDEEP:	192:BplsEnc6YgKTySu6RHlDurywDbmGVhAcP7vDxu3D:BpCE1CySrS9DbmGVhAo9s
MD5:	DD86572F749C7C30A56C108BD4EBB049
SHA1:	FA39084B741BD8A71632B695BA3FB250DD6D116E
SHA-256:	225435FCEEF2C5248B7B10FEC4CE629102BFFCAABFB65194B5D9ED7C73AAF1AC
SHA-512:	D975C0639EA8C737718144004A058C9D1DF479A2D7D4C5DAA0B2ED2E8C468BC2E0AED971AD3FF0D769DBE4901057571A014FF58CA6C827A71B7763929E5BE029
Malicious:	false
Preview:	.NK.~.kK.......RTu..;.....~..c..<..NO.n..$.Hh:......xSy...S.H.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{24a0428d-deef-42cd-85c5-(...t.d........D.;..1.HP..c...t..s.....`*.f.A>c.V....-O.G...G.W.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/......Kk.....Wk....D...^..g.x.6;.>..v..g6.......uJ`.......itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoR_O17EnterpriseVL_B3...2.6.q.....d.;..{.U..~...+./..".Wo,.l..v.......0vKl...O.R."><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://=...6.(H^.......Yn..f.T...2...V.....5.W$u.j..`&......!QQ..p.U.rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0q....-.~r^.......P\|..9.W".S...B.....;4y.

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10951
Entropy (8bit):	7.126057115782413
Encrypted:	false
SSDEEP:	192:fN+sNzlrPb4UrPWn6jiYGOxTojMWATuhB/QghyFDtKGby+V0kOG6ow59A:V3UX6jiYZxTqMHshWDtK/nxG6T9A
MD5:	2F0D3A5C40D939F7B7A472F92D423D94
SHA1:	6300BCB535002D76B0484D7B3B81A0E3D07474F1
SHA-256:	26B4CA49EAD4BC46B06A009D4DAF7D412B7EF1E301088A27EC6594639B098960
SHA-512:	D03225D33FE7E24DFAEEFA42353FC3C25A95533794181C24A335041384930D1BFE66283430E3D3716E8211C397E086FAE0022DDB5239EFC23EB16DF074FBCB74
Malicious:	false
Preview:	196.p..yp...B;X7G3.$.....D8........m.4.9+.....]#i...b..6.%....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8e09fe77-e291-4a12-87d8-....y..s2..Lp.!.}]y.H..R%......{.k.7/.......kU..C........s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.......Yb....$.{D-A0..D..........+.yTj\|......r/d...uR...?...../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .......(r...U;Y>X/.%..V..f;.......C.`Rcg.....X)9.-.i$.*.8....s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b...)..}`...a&G.U_tF.Q..l9........e.4._T.....>D...t..~....=..PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4....$..q....Sbm;-gd%....q1......_.\|.)

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	31082
Entropy (8bit):	6.79333238907543
Encrypted:	false
SSDEEP:	384:OT0Ki4sjauPYf4OGow9WgjG56gn/cNqCgfN+Uc5jsu5HDJDiq5apw0cqLlHbyv5i:OvcA0o0GhnMFg8WpjJdbyvIX
MD5:	25C4BA2986E7FF88845A4ADCFACFDF17
SHA1:	A15B0AF51FD7FBEBB409F05574BFEEBF539948A1
SHA-256:	345ABCABEF3A7A60448FFB8775C471F82AA331EA6BCE6161811D0873DD8EB029
SHA-512:	60FAD96A5C90345F881D17CA62F3293D1931ECD9FD3EE7457B31EF42B04D08397432194209EDC8B35C7B3034C654364B2052314A723747996ADA872AFDB079E3
Malicious:	false
Preview:	}h.[.p..3...8..~..R,v\|..^.G.M....g..\...6.U...l..H.@..{.s...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b8bf10af-2f39-6581-ce48-82551e24c011}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..z..e..1...q..u....y3n.....E.]...V..)..Y.O...%.@.FD..1..~....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeBF3AB6CF-1B0D-4250-BAD9-4B61E.&R.9V.C5.....u..@3&f..I.FH.....r.KZ...0.....l..W.E.\:..7...15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..XU.\-.eW..w..y...U0\|..Q.PK.....).....g.....k.O_...0...#../TM/v2" value="Office16MondoR_OEM_Perp"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www.m..f..g..=...d.]..1Pfs.....T.Q..Fc.V....s.]Q....s.\B.C..5..m..policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-..!R.JV.+W.i..,..Fl;0..D.M..Q..Fc.S...

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11901
Entropy (8bit):	7.0301740462958415
Encrypted:	false
SSDEEP:	192:k2iFjdQAVrb1gbwb15RcMJqlhXqth09TigpDuyq:liFa4bqbw5RjJqLXyh7MDuyq
MD5:	20693EDC4096A7721E78FEABAB05D8CD
SHA1:	FBDB29B93F2DD37E05C5A6D0DD8A6B2CF100E582
SHA-256:	063278C68ED1985609A8EBA28AB149193F85104CC5D58502B0821FCBA30701CD
SHA-512:	4F5BB6FA03819F0122EE91B0C06A2D079D381ED1BC9B2B8096C5040BD0F39B34D8B842CDBC759102A96C6E29A32188C3F5F86926AFFAB06430C58A76E13425A4
Malicious:	false
Preview:	..Q...LA..Bc.f...~..._...]?Q8..4.1....@yuL.-.N#G..5...R.N..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{7470a957-b018-4182-a2b5-su..........L(.pS[P#..D......^(.}W.".n......\|...e!x.-7.m4....M..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.A..g.lS....\|...Lj@.HV...Z;.:\.r.E.S...R&C.;..nP..,.....R..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoR_OEM_Perp"]</r:anX/...O.S.....6.z.QQ"u.P.....A..vM.3.G.Q....?P.jM.4:../..K.p.sessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000/r..R.S....6.[.\|[)b.PO....W-.o..>.`.K.QI.J..:=.'I..:N.\.L.rxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI44{8....o,..b9.Msumhl.~j....ea.~....a.L

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20245
Entropy (8bit):	7.137761218502295
Encrypted:	false
SSDEEP:	384:426h54toD3AiSdIqsw7I+v/hXSFmgznCPYRbPL7W:O4tosDIwv5XSIg7W
MD5:	9422E317153A55A68D988911F74B577F
SHA1:	23521818497FE36D4F86632D590797F73095841E
SHA-256:	F974A45169D3BEF696B1298A3E75A40883CCEF4BEAB747B22B40D89A8190FCEA
SHA-512:	AFFC534C3A6BAE3F77D559563E26FFA89E4D0CE5C2E03EFD8FAEC95870322778C20FC7F182ED57973083C39D879C9946978C6B0BB554BC0740BD113071F29312
Malicious:	false
Preview:	=...n..X..a.K.$..L.B.Oy?x....bv.j.xci.SE:...7.}0..6B..".k.Lr.A.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4af46359-934c-4227-96a4-..p.7T....7.EUk.......!g4...Oaa./.au!.CK>..aO/x31.(..z....f.^.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.g.....x..P...y..R.V..-6s.0..er.h.:%..Q.l.....}0..6%..".'.B7...:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoR_OEM_Perp"]</r:a.m.....FR.w.W.u........6z.C.Oj~...`%2..4e...:.n<.Vm9.'.$.Dl.K.ossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200..s.~..XS.m..Uu.=.'...;z...IA~.=.yvz.0.2.....0t;P..4....1.x\.k.kdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI..z....eP.I.z:..+...U..T...Fv>.q.h.0...

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10943
Entropy (8bit):	7.084569617668785
Encrypted:	false
SSDEEP:	96:riSm/hgZGH8gYQaZrkEKqZmHGHB24KQ6gRAhu9V3oE9qYwUP0xD3BxS1Wh1Rz9qT:khOwyr8U4GZptfv0xLhrz9l6gPLrpbm
MD5:	C7264347AFF6F8AA671972D6FE7021FC
SHA1:	C60B20FE612FE47E7E7655980C55FE6A5E8AC5E9
SHA-256:	E3412EC12E21E3C41620F8FDD19B237DC9B6EC775A0D322EFA5D9AD039343334
SHA-512:	5966747F0B79E95C7067699FB2D8F9EF4300183C80D55000686F275F444D2A206D9170DBA8A6372AEF2A4E5A8F11DB1C23A6B4C1ACFF7AA958FB1FDB33EDA6A5
Malicious:	false
Preview:	..bqn\....'....:."..X.@..iK.q9...].h,...E,.....t.'.J.8O..kc...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d3579e6d-1895-4889-b6bb-U#.}f.....{..J.,.lV.R.....V.":..E..~dD..Kn..I.Y<../ .`qy.&w...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/)..b.V8....5...v.<J......4k.~>......QV....6...$x.1.~..eo_.jf.../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .$..0I....+....3.>.......KH.&k..IM.FnO...Gb.....~.h(h.,S_.&w...s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b....7wM...r/.....N.._....AJ.r...lZ.`L....-g.D._i.#.G..}.X.\v...PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4'$.}:n....-?.X.6.vo.[.X..\B.l....b.ZqS.

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	31080
Entropy (8bit):	6.732377493998297
Encrypted:	false
SSDEEP:	768:zXeuxJC+xavCFnDSLNMVzq8gC/93btm3wOjK:9xA+TDSLSG8gYmgOjK
MD5:	1059BC8ED07005E9EB0745BE978D873F
SHA1:	D3E79CCBC2A8CEACDFE7DF63BAA397FD05EAC293
SHA-256:	B6BFA99F3702BEC39E7DEEDE6D3B854AF3158848D33A5AA11463D5DD7581670B
SHA-512:	BDFED34EE063745BEC107F396E746099C28D60A713D84E53F5313D1B9AEC3B9A5769F9398E5B54A6D351E61AAC35B18EAB8D4C19C1986BF8118C7804C0578132
Malicious:	false
Preview:	.t.\.__~!..K.L...BG..R.]O;{....p.-...^y.A1.q.q......m..F...#.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{27a63899-ca4e-7b17-66f3-2bf3a31a6809}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xu....JJ/#..W\H..TZ..Q....j$..._....%..$km.a.e.~........w......&..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeB21367DF-9545-4F02-9F24-24069).5P...2Q...L..]......LH,x....5.8.I.@5OG".m.v......gH....2.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/Xj.8R.s.=w..Z@..G...}..@L4z....V&.cF...1...o.a.....AG$......M/TM/v2" value="Office16MondoR_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www.micj....S.qn..}4h.7A-:..#..Wj6.....".0.O..?.Os.!.a......w.....!.licyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-16-.@"... 2...W..._Z..X..Ah6`.....".5.^.5(

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	11893
Entropy (8bit):	7.0466245777735335
Encrypted:	false
SSDEEP:	192:+KAr3iwt8PKE31Q+eMbF3cZOuVYnHqxKhHheMK3imJ5Iu0DugDkEG:LAr3iAZu/nHq2eBSm3Iu2ugDq
MD5:	64E1EC5CCBBC39EC4266D301825E0265
SHA1:	7F114B2FF113348E8A96D2746B76FA77D5E0FF29
SHA-256:	91E6736C07816592973105122BD2CD057E8BC5529AEA40D16BC39F7D9DF8A2F5
SHA-512:	FBE2D700D5AA3D6AAB624F8EAA5475C488B9E3945F4BD9F28E0A566FD1FB13B058B06D4B16CE0D8C779709EAEBF9F146423193EED19A6C236F1B5CA67C8196BE
Malicious:	false
Preview:	...u......]..i..l.o..`.F..n;./.....a.6....5..UHF......T%t.-}$rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{3e73583a-2bfe-4427-b7ea-D.Uy......I..&.."W2...8.P..=8.w......q.2.T(.c..tp.n",..'.9..bps:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/2ezf.....b..4..rK{...i....a<.w.....c.gCDT.:..CC........t%.14jitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoR_Retail"]</r:anXml3OG;.........<..<x-...w.C..F9.2......&.*@.h.=..T..1.....$I.0}{ssor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000/09YOZ%........G..7o ...;.h..r9.a.......kv+r.h...G\|.u.@....u.'\|fP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI449+4E...7......K..va...._._.?>,.h........

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20237
Entropy (8bit):	7.189066152642306
Encrypted:	false
SSDEEP:	384:vInUZM7Tut7hFjx18XkXLE8Usu8VU7JorkMCBdIsPOsEI:AUZMXutVFjf80Xru8VU7JoI7BdI7I
MD5:	ACE4B1A182C0DFEAE17D98ED03DE71F3
SHA1:	4122A4AF706530B87DA749F3BA9A647EAE568332
SHA-256:	75D367904CEAFF3A6B9BDFDF76B976BB24C140E29195FEDF58A5CA790001B017
SHA-512:	58B8922F6CE78C48E782B681BA4CCE810614A7A0DE7AD6766DBEC1F69ED0F05CE29A7C55378B8DAC33199D2C0DD0E5BCB162476CC537A8F23B970FDAA106A5C2
Malicious:	false
Preview:	.a..h..L,ZK.....s..k.(.._S.0K.PS.q..Gr.4%Z6..0...Z&`.D......rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8b71c95a-0e8b-4a51-9e04-u.q.4U..4......#..Ra.p..IN.cH......9..Iv.vrS`P.x...0.W.z.......s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/W.Z....l>.z.O...p.../.\|...s.?L..Q.......$R('@...0...=\|_.V......:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoR_Retail"]</r:anX~.R.'..S.EA.^..t..S..d..N..6W..........).d#...w.W9'$}.D......sessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000/#.8.:..SeK..^......X..d.....6A..........U%./0..'.ZT-9.......rxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI44*.U.e5.oAOl.3.........J..f..vs....6...

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11463
Entropy (8bit):	7.0780509403026715
Encrypted:	false
SSDEEP:	192:A3rVrxRIcCTT1VmX/wToznalLD5omIRLplcmnREiaYobm+X2X:A7VrxWDcIEznalLNot9plcS+wAX2X
MD5:	09A176F9BB281876A642B2EE66318193
SHA1:	6FAFEC139A5954DBBE4DEBA5ACD46DD676673D84
SHA-256:	08963DADE1E68B7F9455282EDDB9CC5C73B967608392F58E9C3B234B28C9D677
SHA-512:	3147149D45B47A58E596FF684081CF40D7B24993A0B03E137220649D7CB6F192184695613BB615928804A60A905B3C8C4BC3B733D6FD1F1492B5DD1D6727DD29
Malicious:	false
Preview:	..l.c.B.......~..M..x.\wz..p...D..9b.....c28..\o..1bN...VN..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{0b2d78e4-2061-4817-9d82-r...>.K....J....... QJjp..g...].Sfr.._X.5kjC.jF.^.:p...BM.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/Ub....b...E.X.}..Y...q..Wx..t...Dft"A.....h{...Jd.h~?n...SC../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll gQ..=.J.......a.L...r.~tr..e...B%Zm`[..!..jfy..Bo.l-rZ...[T.gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200!...s.B....I.T....(...\|.J} ..x...E..t:i..\?.G.oA.d~..9{z...M..rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvVb...$.j...,.[.{..)...Z.NQ*..N.....WOpA

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	31142
Entropy (8bit):	6.7904254399135215
Encrypted:	false
SSDEEP:	384:Lw9bsMaJ78NRSOCKTOJ4Psrae8C052CNeHtGePuMtIcEOKy0em7iZq4iu48pyUx:A/WOJtPBqS0DuaKywX8r
MD5:	AEAB5A90980345EA0F8DFF1E788715BE
SHA1:	8D0D3C871B20D3AB16E4ACD59D9413C0F10FB7E4
SHA-256:	559B4804B294068F7508EDD40F4519979DB2F2766B0C5A3D1CFFBCCCBD85A39C
SHA-512:	4EFEE4D3F8E098CF298550D6505414F206F66410EA250B46B7E1693A2343C6A7611D5BC6BA49183E4C383DCBBA3F21027544E493D737E9066A2B63896238C7A1
Malicious:	false
Preview:	>...\|....'RyO?8....TO...#a.....[K........I.`......X...{.0i..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d64e514e-e3fb-9505-0616-5d0b0277ba31}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x...y...$Ee.;'...........\|5%.C..\|z......M.k.....\.).3.=k...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office9E7FE6CF-58C6-4F36-9A1B-9C0BF.r%.......s+p?4...K.... `(....\^........i.;....].c.9.t-..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..].l....c.5.33.....-...."v+....^.I........O.j.........&.`Q../TM/v2" value="Office16MondoR_SubTest"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www.mi.4~.,....>Z$x......VB...~'(....^M..........v....F.).7.ap..olicyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-1.s$.....bu).gk.........."q(....^P.....

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11910
Entropy (8bit):	7.015785122285729
Encrypted:	false
SSDEEP:	192:5M9nSeWItjicKWL0jwDEV6iT4+3vA4InjGkx+FHNrp:WSwQDrVgB4USkx+Prp
MD5:	DD2793960CBC62966A2D27BE498ABFFE
SHA1:	544011ADE75D261505EE6E0739C0E14C17A5D264
SHA-256:	96C31D4AE4D653848302EFAD44FE555B202CA56393C17576F7F1F28567E95A1D
SHA-512:	8AC930CE66D8C722925840AC6D27172B3E92E4485B3952F54068F5C4DDE96E98C4DFF129F9963F62887B576F33685DA0D51BCAADF68E6849F78E02E52E3CE3EC
Malicious:	false
Preview:	U].,X.4?..m%..n..M...(E.M.,...q.f.=..V.d.:....:.%..j....$.^..Lrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{1f8d6b04-153c-4e20-8e19-..#P.l5..n2..!<..Q.p..[.&...).).+_.F.`.x..AGh.."..K...~QJ...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..+??.....\.].3f......\|L..?....)."M{o.T.5Jh.G..7..G..m....uM..G.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoR_SubTest"]</r:anXm..`.. ..fiN.s~..c..6....'.4. .e.)t...g.).^..{.w...j....(.b...essor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000/0...}..:..iN.R...t..}E..='...9.-..S...2K..D.F+.z.....9.?(^...xP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI449..."6.....E.A.D..Dz..XG...g.L.(.g,1R...

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11467
Entropy (8bit):	7.102032394515331
Encrypted:	false
SSDEEP:	192:lhQ6EDiCjylm2Vfs8Ci+bOfBfmmtnsaWEsmiJOD8d5m:lhtENjCm2VE8BhLtnMEsJznm
MD5:	8DE5B9CC559FA63595761BCCB2AEA6F8
SHA1:	5D2F03805EB0D03742F50E2061D4927EB8D8BF88
SHA-256:	B8BF886606064F69FB201B933A7E5EB3FCF7B94BFE8A0B957B1CBDB9262A667F
SHA-512:	0B407F288D9345E360698A12979869A4DC3655CC2B7B620675958D92928BAA873D2EC5E4086904772A42C5841D148D0751226D77CFFF77A301CD3D35F6112CAA
Malicious:	false
Preview:	.....R..L.;.$8.......c.6...~!q..XD..G^.KtYcu....sa<.:.-..V...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c1332a3c-f50b-4adf-beb3-.t..N....:.s@....;.z...-"f...].M.N.E6.j#...Z...b)^\EB...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/....yX..^...x'R.....7.=.?.q&u.....x.....nW7~.....xU+.g7x..S.R./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ..>.@G.N.7.38.......%....)sd.BB.D.\...H_4\|.....sd/..K..[...gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200.\|..R....7.ts^........4...+.y..AE......-5iQ...bN<.##\|.)M.9.rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV..<.Y].......+Q......9.?.9.f$O..}..I1L.

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	31143
Entropy (8bit):	6.798582824886912
Encrypted:	false
SSDEEP:	384:pr+z5xmsdaXwtwo0Q+W2Lq4uCKZb5R9tVCNSHYlxnReP0wdSXBn05K00tKsfsjtE:c5srr7Ru3Z5HShxqgi803+rH
MD5:	723BE4BA2E9A108FDA7DBEF6ED7C5084
SHA1:	D7FB274ED2F902417357CBAC8C06B0EFF4E9DEE1
SHA-256:	AC681C8BE59BA1CFBBDFE7C968154EB1111F82906CB13FC7FF767D041783B72F
SHA-512:	CEF2E6AD0213AD19B3ACA1B815495F1E784591DFE11AF680954AB422985708CC028E84E428AEAB207956DFAD1CFE26DC245C7070C89938D5B7A56F5552774E18
Malicious:	false
Preview:	+'..A.........^k.mN..(P...<.Mw./.}M.N....L..SB.(X.4.,....T.z:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{ceae6991-dedd-6034-c54e-53614ec70143}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..y.D......P..U1.1...:...h.. . .WM..\....X..X_.>..{.6....V.c.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeCEBCF005-6D81-4C9E-8626-5D01C.U.M.%..&..U8.9\.2A..=..b.j.u......P.....!B.,.&...Y...q15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..[.Q.)..V..Y".3...(M..+..x.y..4O.....R..YJ.c..4L...g.l.&/TM/v2" value="Office16MondoR_SubTest2"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www.m..e........E. }y..-..'f...j..,.a..i............_.w..0.0.....R..policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-..".J.R....H.C.y.0Z..d\..6..,.a..t....

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11914
Entropy (8bit):	7.115624541718613
Encrypted:	false
SSDEEP:	192:8Wmz+IwYIb2wAHi7yTID6M2giskUm7PvbyFk5v3Fus/9:8Wm69tAC7yK6W0ym3Fuy9
MD5:	66493EE5E17E74FB64BE94714CE9369B
SHA1:	D818B5DC0C9B46A6DBEA6B3CEEF08EC775CCE47B
SHA-256:	2A04DDB474A61F5AFA4D4DCB842F85E43F05F8630C5F1EB84036E51C8E1695EE
SHA-512:	3C5FB88372712905256D9E58BDE218A1CA3B68BB89EDC2CD1035BEB69E6FDB0EF90937B6E169716D7C1439E219A69045DB0FB45495E31A62FAAC2B16768F031B
Malicious:	false
Preview:	iQ....:..1..2(..M..+/..Fl^..........EX.`}.{..C......-.K.Ln..@rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{49850d50-cf8d-4b9f-bd83-..b..e.!.V<c......!~..zC..GJ....H.ds.,.....#....u.8A.z...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/........h.(n7..N..od..M1~....G.....1Z.1#.P.O.......4..J.-...itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoR_SubTest2"]</r:anX..F..2......}..J...Za..}.....NA....3..;\|.}.C.O.....7...U{...sessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000/..{F..3.. .G.}..1...Ml..M1.....NX....L..).K.D..?....".2!B[...rxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI44...L..0..$.(.r..=..CN..OU.....[I......

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11467
Entropy (8bit):	7.112926987218321
Encrypted:	false
SSDEEP:	192:dOUm/ZMA8FwvSSXKpFeCKkAZmwyldIQmWaac6aZ:dLm/K467pFRAZNAzuaWZ
MD5:	66BB1BAD27E143A8C4B28DB8BB51A98F
SHA1:	4C5B0BE5C37489B282783E6219111F34C785A798
SHA-256:	35030593E5567C175664CD861C819DC792D776B442F46F72FF44DE0D5500B0E4
SHA-512:	C924C1A28669EB05F2965A5ADBBD04F90EE43D4AFF2C8ECBD8075F96A33A5854A37EFB4145EAEF8D6CBEF42D00436FE4F7691030E38C9EFDC76E236D91A9AD24
Malicious:	false
Preview:	.$.n...k..L.....>..i.H.:2N...h.B7#..v..?.AA..{.)..h...;n..P..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{1c2a07b3-3c0b-4acb-bcc9-..bb...>..J....nI..c.....'8...-.[!k.x.}^H..L3....I..0H4N.S..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/x..}b..K..}.....=...-..C..0A..j..q^..%..%..J.1w.?.....nt..]../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll J.$.[..:..@.....!..+...T.9:....,.D.b.?.....H._j.7..{...]z..J..gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200..fk...kH.@.....Qv..<..J.0h...?.C"0.....~9.e.I1....h..:je"....rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvVO.&!B..r].m.....;......A..bV..}..(o.%

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	31143
Entropy (8bit):	6.768393946619092
Encrypted:	false
SSDEEP:	384:ngdHlFsCaPpaVwlmZOBf4SebKuFGCNODr1VmzJaEeP4QfgxHwWQzZ2VFIrE/e8WR:kFqaplbdwSu1VmVa+Jbe8woBe
MD5:	22651BA6FB8943464CF877963DB245F9
SHA1:	A4CF8F70BB6B2F1478ED0EA5F964D5834A42EFF4
SHA-256:	B22D9F1FC43A7FB67365E79337940F7E647A21ACC65E2DF1480FC9C8720F67EB
SHA-512:	EBD95D18913C35B79A4B251FE67F794EBA21D16C95E966893194CB8ECF1CEADEF67C4CA681CFAE6EC17A92796B2240728B6738B35902D70BB6C8E2F019298698
Malicious:	false
Preview:	'.7Gr..xl..B..[U....F.4.z.......^.xrq._&..y\...3..#....W{..%.!:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{7b84dc07-0ccc-3b86-5d53-c05dd1b6c12e}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.M..w..)n..^..D^F..@..&.....%...Q.IXq..MVA.cH...z.f.....3..'.8.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office26421C15-1B53-4E53-B303-F3204...Ju.\4......W^O...Y...}...(.....mz(..t(.3@...3..<.....9..a.*15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.l.Ib.&;:.....PRU..^?.4.y...+..L..6;s...6.. B...4..4.Y.. &....}/TM/v2" value="Office16MondoR_SubTrial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www.m.B..>..`b..]..fv...}:.;.X...4..K..\|f5...lk.q...,..).....p..#.upolicyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-...Ny.]$t..r.........x.w...b..K..\|{0...

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11915
Entropy (8bit):	7.103549779912323
Encrypted:	false
SSDEEP:	192:IZiJuLODwM2XTspzfi+ykiMzsefaUAXdo9p0IjqyyQBhAm4N:8ODispW+yiseJASzbjqyhkD
MD5:	7C7631FC28110245120C4412B60B4883
SHA1:	930989057C3E20D36C3EB6F885AAF8DD9A62A1AF
SHA-256:	37A8816F5F2E7F5580A354D5F07DF1DED9D35F571DED626A6408EC391A52ADED
SHA-512:	918DEBB4F04FA1005D859D7D39EA289AC7141E80A6CAC873679C7D574A8641F2A8694F8638A7072D696CF72EEE797E036441D072CD4C83026B9299A0ABD0298A
Malicious:	false
Preview:	I.a....zS*@.[.L.['.........c....y7....V.e......L.B..$.>R...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4ce04c30-a17d-4a75-90dd-..Vj.....i.:N....J.z.....H.t...1h.....Bl...!e..uJ.W.sF..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.,xr....#b.....O..3U.......g......C..A..>6.....D..O..g.o...itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoR_SubTrial"]</r:anX..p%.....eY6....K@.{`......E...&A..K.../....X[.._..a.'G..sessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000/.G.%.....k.z..f.0m.pw.......q.....f..v.G%......UH....].0g..rxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI44.Uw/.....ot.`.r.<d91y......].=....>g.

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11471
Entropy (8bit):	7.092992141087229
Encrypted:	false
SSDEEP:	192:1kcmh/LAMNAN94eaUbHLWdmIBvFolm7sRz+yJ22U:CbelwelbHLq9n+isgyA2U
MD5:	86FD81650D4B29F22FD9E57D9481FE7B
SHA1:	2C52417C038EF7B0B984FDC6E1B53F8EFEFA0C15
SHA-256:	8F1D8620276B411BDC86527CD2DC228CB519E47D3C332F80518A67FA336FCDC3
SHA-512:	5EC7EF258BE60014C5F7626101DCF1A7C32AF72FE749E1CEBEF88888176331AE076F2D13CE3DAA30D6DE5AFD0F934DD3670E370F9E878F6C7E6E9FCC9E5AEBC1
Malicious:	false
Preview:	...'..U...)u......y....#.B.we.......P<.....Cd..(.Nqx.Yw@,?...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{71d4252e-fa9c-424f-9c0f-[)+.......o{.....$.B_Wo._.$f......,.....6....$POAg..a+...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/z..4..u.....)..Z...m.XS.(.b.xb........\|..[....K.#>.zf7Dy"Z-:.../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll H-9U..]....5b.....x..A.?.A. 7.......>..Z....%.)6.Kbd.M.T.2...gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200.c{"..U..<%.D.....Hq.!.H."F........d..r...s3....aqp.m&K.$..rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvVM\|;h..}..6@.........]-.d.o`9.....&..

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	31144
Entropy (8bit):	6.802626852613469
Encrypted:	false
SSDEEP:	384:AEBBsCaz7sqmxRan4a5AQfSFl/1GCN67DNaePwODXkL4YBX2BX6elj/CWw:pGIFdBBGSCcz03Z3w
MD5:	74FE54E669878C225BD15DA4BCD78C69
SHA1:	0BB3B4D2E2469EACF5A907E6EEEA6BB253FE92D0
SHA-256:	8BA9E6FFC6BD2A2D2EBE0BDFBFD9B5425E740907A37EA871907C547D0F24EAC9
SHA-512:	4C0D14B0FBE9D5ADF7C6F9D87648B6B44A17EDFAAB0CB6746925495B54F80B6FB3C1FE46832EE61E5C05116E8D15E8F77D0C45219A64E9C2F820DAB22F5E62C9
Malicious:	false
Preview:	2...^.^....K.......I.K..2YMt1!.>n.A...O....M..1..\&.T...X..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c99fb2e7-3553-a77e-1fd4-25b09e83a0dd}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..#..K.\.9.O....J.X.....m.. f-.._*A.....U....PJ.}..X<.....Z...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeEE6555BB-7A24-4287-99A0-5B8B8..x..........K...XB....Z..1X.&$&.9{.......=.....+..Y,...R....15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.....~...i..G...BH.t..V..3N.8>h.; IC.........E..r.....#.l.`./TM/v2" value="Office16MondoR_SubTrial2"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www.....\...(....&....p'....rK.8h .' .......K.DB....+..Y'...M....:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6..{...q.N.y....E..T....B..$tJnh .' .....

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11919
Entropy (8bit):	7.078313631466719
Encrypted:	false
SSDEEP:	192:tqiZmx5vZKUvBu9SniwpuD/YTjaNT56z4FaqQH:tqiZgoYuUVZ+p8ssx
MD5:	A64E39F8F12807BA59EBB0B2CDF766D4
SHA1:	E843BA2F5FF63EDBF2EAEE0CD9C4A2C9D778F601
SHA-256:	BA6E0E6E466EE7C2B777E6B2996C484B582AA4F1CD19F5A98FA41FA7944747A0
SHA-512:	B0C5E336DE7AD3CD3886E2C903D37EE633BBC55E0A4EA0D710708871A6D029EE59E1F25645272ADA874F2ADC18D3B941C5CBD749DE7423E73FA4A7F58C58F1CF
Malicious:	false
Preview:	..V...zQ...LRX.i.<.R2F.3.)..K...\.1.'..#KW.....2H..^@.M......rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f17be56e-2408-472a-ac64-....rX......N.'.a..j..%.#X.\NT.E.yB7..-..'...P.~...i..>...`.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/....Zq....S...w.(..fO.n,+..ON....Ii%..}.\|}....9....SY......6.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoR_SubTrial2"]</r:an.....eX.........q.}.1~O.l.w..^j_...}WK..z..u....~....AG.....\.ssessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000....{Y.......d...w.&sO.5]q/.H^_.[.pdl..GQSC...L.u...H..Y...`.drxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI4....FZ.....v.p...A.(Qa.79~.Sz.J.R.KOm.

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11483
Entropy (8bit):	7.121089374978086
Encrypted:	false
SSDEEP:	192:Se0TFF9eZklXzPoKlThIIA/+fExLInpRVpMVzCWR:2TFFQZqXKIAmc1KpRVpMZh
MD5:	520B7E35F8D836361595D6946D17F367
SHA1:	99DFCE9E00849E7565E7ED73FE8C75BDE6F60A57
SHA-256:	0A1D15A752C6C8C99A2A57B642B270A493E6002A5E997298E5DAF7362EE0812F
SHA-512:	C4D7EF37CF004DAD8020BB1969FB0BC7C26640AD06CAD09E7FAA8FD2A7052858A624754BF3F6310C83E138D170F08420E18370DE953208F6917F872B20972539
Malicious:	false
Preview:	.F6f..e.lKnJV..<...pR.....%....Q..G.... .R.{\|.h..._A...h]A.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{7d3a9423-30a9-44ce-97ad-9..n..1..n]X.....!.......&...G.G..W....w...)4.A....J.\|^^Es:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/E..u..E.~._u...p.....;...E.."...L_..........Y.Tp.c....a...mP../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll w.....m.n_bVA..5.....h...:...w.....v..E....&.[.:m.h...OU...eG[EgPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2001.c..e.(Nb_..n....+$...........D........v.,6.y...Fu...s.pZrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvVr..)..M.=.OUc..5.....k...... ...-FN..U.

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	36007
Entropy (8bit):	6.814581989909804
Encrypted:	false
SSDEEP:	384:wOp5B8y4r2zUcXTSGSggzED26sgVXLu6SY5mXRq7D+GKkcBiTSFAqV195sqez55z:1CLPID2gXNDwIKkfkAG1uZ2ryV79Wn0
MD5:	8FA96906C2998FC58857B7C21B54CD41
SHA1:	C661AE0AD027CB3E44DBA08F21D3C69C2B33C686
SHA-256:	A2E4A9C1D75B882997420CCCFC7221504D9039BD6C00824141C8D8D85EA44CD3
SHA-512:	EA7A7C55E16884BE417FF022B94D19943B57565E352399C1DDD08DF80241DE927F67567FF083EEDA663ABFBB9CA15BE3CD26E6F184977370AAB4502E929D0040
Malicious:	false
Preview:	NU._..Q......J...s.^....%.....%.-........!p9...ds%V../.5uz.\|W_.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b5082dc0-e094-3299-e565-466e1ef7d399}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.............U.W./.....Kt....)........j.qj-...y:3..+.2?2.qUZ..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office69EC9152-153B-471A-BF35-77EC8...P..=......F.^.'.A....2....."S..C...H.2:%..6s,L...x48.8.N.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..Q.5......A.D.-.'.........l@(.......:)'...ltn...l...'.,oa./TM/v2" value="Office16MondoR_Subscription"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://w......R....J.....A..=t.....f..[...M.!#!...:0\|Y..y.4&g.7VT.<sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-B..N..M.........s.A...).....v@f..[...

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11931
Entropy (8bit):	7.086750960824503
Encrypted:	false
SSDEEP:	192:c3GOUNBH16UzoakoFhgy6Uqi1hB2t/SI1fqNVDilGJKj:DO66lav4yNRsrypilGcj
MD5:	B06628EAC7068FB56EEDA47B1D3D2EF2
SHA1:	0239DA5C2348A891CF88C663EB7245A2C447B23E
SHA-256:	2A48E929FFED3D526D778EF0075F9053EB7B4199E0BBD4B95BF4E6319D0050A1
SHA-512:	CC1FAE53ED4C28C0635199B46A3B7361E0281F461B2A5D28F8AF8AF9F7F6B8EB00C931DDE9AECBFE75CA2C965CEADC30879063BC2F164E4D98846ED4F0B675F0
Malicious:	false
Preview:	..D...ax.Q..o......J.l.\|.e.....Q.....O9....b...,.:.3...b....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8c851e36-c333-44a6-9386-R<.Y...5o.W... ....H...4.j.o......J..A=..I..;V....P<..a8D....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/"V....2AjF`..2.......e.!.g.......z..hZ.5..n.....-.>..Q3X....itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoR_Subscription"]</r\e.c..:u(.Q..o....I...{.s.?....V..C...uv....)...6._Q`.^Bh.....yPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2V4....Pu5.P...#...h.#.p.~.t....@..Z...FQ....h0..1..!m.-K,..!..YlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZS)M....=.j8S..B...~..1.\.Q.....r.K..'

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11487
Entropy (8bit):	7.061579066424041
Encrypted:	false
SSDEEP:	192:EKGMlfrDU9i4+raMltKi71kUixAKiXjKJVLL2L69lOUY9l:ErMduuvKLA5mtLSQ0J
MD5:	214E7349562CAAD989953EFF04374F18
SHA1:	6A96EC1733E8A7F8061A2633BDB52F3264698AE0
SHA-256:	A30F4C90558FC9D136FFA9745685C74FBBCCCA49ABFD03D2689A2524CC20E8A4
SHA-512:	A004A9B23166C0C17742B2D6C4F339C09A979903CB22749E08A08A22953A31275A4696CD102CC06D387263D43505A7373AEAD1058B02ACB6E657FBB75BE8682F
Malicious:	false
Preview:	.pgZQ.....;M.f.....n.Z.$..tR..3AnD.~.v@..X.[...R)c`..hG...?.ih.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{04fe0589-2bf5-4733-8d11-U..QYY..@.o[.-...C.d...h..~...k.!].6SfN....R.C...UI.._...r.jwYs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/!..I6......r.y........./.v]..kC...A6..VB...S.^$uk..'....>.d2./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ...(......7Q.f.....,...8..\|..4.tB.?Xt..Wd...N.C.}`..tW...=.srYgPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200U.._A...G.7X.-..\|.;.,.&......j.wE.mA.;......*...[q..`^.....3YFrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV........R..R.u......)...-..$J..OTK..2zd.

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	36008
Entropy (8bit):	6.804812807680439
Encrypted:	false
SSDEEP:	384:WXRScmCk15mUGXpgzN4suqzOU1UOR0pqJF4KY0zQ+LpPSBAet5BCFmcErT8joq6y:W8cM3lz9U84foQsp+VJcTMKSNNM1p1D
MD5:	744E48039F9864D7DC05FEF7132BE383
SHA1:	83F5B90A78AFAEAD1360674044316A69CCA453CF
SHA-256:	9BF191B0498BB24BCEA576BAA43D67CE2B936F1D129E2F7379D7663C60627A17
SHA-512:	A85929CE65D5E848134875C32C41FE0A979FC84B83BE347E84CADEF01A6FEA89CC6DA6146A7EAE1FD3B9D8778C704887E1CC743D3E13164EE765E54B54A1A874
Malicious:	false
Preview:	./.RSd.N.2j..F1...^.T....g.?iz.MJ.Y}.T.S....BT&.4...!.V.....:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{3bd0af18-9051-ce64-5406-504a0bdb77b4}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x^.g.Vq...1}..B..........@8.e=-.Bm.s}...#....F[-.}.LJn.L.........microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office37256767-8FC0-4B6A-8B92-BC785q.MW(,....K..F=...L.....d.h;o..M.Q$.J......bS}.4...9.\.....15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/XA.E\CH...v-..J:..........f.k%u..O......C...DD,.3.C.!.\|....../TM/v2" value="Office16MondoR_Subscription2"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://D.~@.u.P.7`..=....".Y...>:..K2.]...#.L....._N}.w..X?........><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-q.JXA-...pM...l...A.Y....g.?dd..K..#.L.

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11935
Entropy (8bit):	6.991430323946597
Encrypted:	false
SSDEEP:	192:mWPm6QiGThYhbKIAliRvYZRvkmr8Bkro0q2lC:mWSjFd3qAMGr82lC
MD5:	2FB6398DB7984C0F0B2FBB93B2042DAC
SHA1:	E902002892DC6B2F7C359AF0429EE41BC948012F
SHA-256:	EEE54E9FE373C8E6DAF2BD769E840DE2F0DEA9CE1F4A79B8D3381EBE6B10C9DB
SHA-512:	DC153BF2B3AB79436D397CDC4D6BA1C0EF81CF3D881AEDADD663F831CBB37EB64899295363C2C726469BD46C87AED3C1A5F4A8A021CC5A7647DF82B35D292A62
Malicious:	false
Preview:	....mQj.@zA.c..~4.g..o7....../RJ%.;{.o].8C...r.(,fv.:w..2...%...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{5b289df1-cccb-4f94-a6a0-C._.fL1.R=E.m.Khd.8D.>o......,E.`."mY0M.<M...$.zdZ@.PV...pT.1...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/f.w..[J.R#p.?.Y27.$..$c.....(V.'.y=i._Zi...}.%:m%.-p..+@_.f...itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoR_Subscription2"]</P.[..Dk..\|V.c...g.j..wq....}GMa.=\P;_Cg...{.i(xu..'..0...&...tyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/....}.>..aH.c..3+.je..\....$.KJ.+hP"..j>...F.(.Go.Lw..#j..3..cYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZq.s.f.,..>u._..RD.eq..U..<.&oD}..$E3.A

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11455
Entropy (8bit):	7.099206229463877
Encrypted:	false
SSDEEP:	192:qNUxawXBv59XnWgs4zuDJsJfHvTE1ALmLYefpmEmJA/jEpOcFywMYK1:6iaqHnSA9vTE1u5QRdrEpFYcQ
MD5:	9181C5A7A108FAE673B16805936EF37D
SHA1:	7A43699DDD11733A1BEC6CC4C9D833AEA7962BE9
SHA-256:	6FB919B10DF39999CF0A16E644091DCBA98D6C2AFCBCB096A5539EF237126AC9
SHA-512:	55B347D36C536E240223E1F480C6D1E2081FA81BFDA7E80C1E8280E19B4DB7A3DC1E7A38ADA237322FBF3C1C8C0908B247E3730A19584EDEDCD326D57BD8CDC0
Malicious:	false
Preview:	...[.0.p&;.~..<.K"0.Y...&._..D..`.T0..@p.s....).s.4.s.J>....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{113f6e64-c01d-49de-8c07-X...T.i.ic:.p..l...:D....;......Ly..o..N2.z......Z...AM..s....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/~K<.<..:b..."...?..6t^......P....G".)}....j.'...$.x.{DS.P?..../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll Lx....8Kr27.i..#.F#r.....%....C..f..d...L.$......s.(.g.^<....gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200.6A.K.0.4#7.....S.;GeN/...,.......a.G}...&1.:......b.<.G.A....rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvVI)......!b..K...9.-Fw.......G..8.&;..F.

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	31203
Entropy (8bit):	6.7306610664506215
Encrypted:	false
SSDEEP:	384:1zkIHs5rsKQ+TdsNCJBD9+0ZJx7F30WNi0d4iPhdAlYeem5WnHrgs+ATw5a6ch7K:jX+vx2Yic4iPhDR+Aev85ae+
MD5:	9F06B06AEDECEBE513B4842CD142F5B3
SHA1:	2A4B3C8DE7BC87CEE6989C9B28D3510E2F21D8A8
SHA-256:	AD19C0ECCB8D2D6248CB324091A698C38C0EC9A7FD1157F060E2E867B6DCA769
SHA-512:	6700D187BC7AF08EE691A2E024982323F2238D797549BB02A1EC7ADA0DA9BCF3F60EFFD2A4A0676C17505AECB459B6CD6405265A371C68F62E9A01F033EB0CAE
Malicious:	false
Preview:	..{...;P.$J>.n.....4.2.y...n.>..s....[.`ns]-.\.^..{..w.7w.\:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{db390b32-3438-1099-62a1-ead2c101cfc9}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x/d....jR.3Vw.q.L..a. .-..B.:.2...Y..e.+.0tgY".A.H..4..=..:u.E.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeD229947A-7C85-4D12-944B-7536BwJ...w .....b.E...+.(.~....<.9...{......s$o}*...W..c.X6..s3.W15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X0E.....x..c.q.e._..M.2.z...".w...:..J.K.{7m[=.T...{..4...gO../TM/v2" value="Office16MondoR_Trial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www.micr-{.....8...j..Y.f...W.=.%..N.l.s...g.D.W."h0G".B.R...Xq../r.^icyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-165w<....d2...q.r....m.k.y..N.l.s...v..S.

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11905
Entropy (8bit):	7.031299445290589
Encrypted:	false
SSDEEP:	192:wn7wE6/VX6lNjaw/ng6iVCsnPeGMqwVLeWyaZnKDmnBCYqO:8vVaw/nRPgUXt7ZbBCY/
MD5:	52970A9BC244CD2FB0F692C121CCD1B2
SHA1:	53F36CF54FD5475974420E78D4AA3E2C701A0A49
SHA-256:	AE829B4B56D40571194CACE13F6B183BC26D971C29DA5B99F79A365D09F4AA9F
SHA-512:	BAAFA500423A80C976D8CD12E650D18A4917C901BBDDE3733C925EAFF4E349C8F93E442DD504BC482842BF297005C317D7AF4767C2E0B7969653E7E2C1F35109
Malicious:	false
Preview:	...&..W8KL.!.X.....ZP..%...9u.7..{ye!3#8.e\m.0y...F1..l..jrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{cce99c5e-e288-4456-98c3-...(...^.../.........Y.3.....a0D..$ik%=ao..<.%..P..;.xB..x..>s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/c.65...w.}.}......P....x....awOu...{5pmq...iQ{.c4..._r../..$itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoR_Trial"]</r:anXmlE_......Tv... .Q.....D.^.).....r6...&fx~.!6..2.z.3n...Bh..s..#sor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000/09/_..~....:.....\|....Q.NX.)....:;?...39H@;1.B.i.:..:.UH..d...9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI449+BU.}...yUn....u....t.W.i....p..+...j

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	29606
Entropy (8bit):	6.6961112283249395
Encrypted:	false
SSDEEP:	768:SGsLHYThrKZF3SlRhMBK8XMrvX1XEAeGs:Sz4cZ5ORhMlXMKGs
MD5:	88C414B29E5273C5633F849AD4158952
SHA1:	8CA6A1B57A901329E8147BC94258BD3C93634741
SHA-256:	A208037DCD1DC0190322DFC89480EAFAD62B9F0E12797E691432181B9BC5417C
SHA-512:	DD97CD69FAE526CCFD11EE5524CB7D43A50D8A9D7B5BB99661218526EC62DAD1E2A071D8CB320091FFBDFF44321A8CF695E6CBF361CA89612B37605DFDEE2C41
Malicious:	false
Preview:	.....-B.?..\|..N.kD+.3"ys.........'........o......6'?..N..i...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b81035d3-1b38-4700-8e4d-d5e226c00cf4}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.plZ.8W.=..`..Q.1\w.fgk'@...T.............{......zbp..I...d....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office762A768D-5882-4A57-A889-C387E.)A.....O.....B.8...,rcb....Y.....2........Ms<.D..,8'......-...15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.QN...b.i..0..E.".u.Jdyn....Z...i......^q......u0?R.o...9.../TM/v2" value="Office16MondoR_ViewOnly_ZeroGrace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="ht.l8.."X.1..m..R.0.4.lmvR(...............s......oa`M.....q...ority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-.^F...n.)..8...`V".0B{(K.........0.....

C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ViewOnly_ZeroGrace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11952
Entropy (8bit):	7.0821688126477085
Encrypted:	false
SSDEEP:	192:If/9/eU1g8C9CAqZP2AGCCq1TRenEn6pTm:A1/eqQqeAGCCq19iE6pK
MD5:	7B853961C6BD6DD456090DFC54AB7CD5
SHA1:	A34022C35DFDEE3BFC0CE41E8AABFFE36D23CB49
SHA-256:	5E21B905186E08CC68CAE0A7621DE667C59A1FC112B5B154995C65BBD195B5E6
SHA-512:	8672B2DF0A6BD3529883345CA246DC30A27EE1B5C70583493860E85DEE919CE8C8078B32DFD9AC6B43DECAD80CAE5F97AE5EF8B3446EA08779B0D46F2FB4FB2A
Malicious:	false
Preview:	..-....dK....&..k.mc\[..5.XQR.7......2U.x....p.....]...5mZ%0brg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{773e0e5b-5e8c-4cb3-b4da-.,.....r\.Z..i..%.0i....#.R.Q.o.....<Q.:....^8.-;g.j\..o N&/6s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.......v..#..{F.u.y'....h.Z^U.o.......b......f.H_..P...d<.9y,itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoR_ViewOnly_ZeroGrac.o.....e....9..:.<.E..$.ZWN.f.........f...!t..Jh.B...o>.9y(ropertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.".....t..W..$..:.$p\E...w]E.k......i.......#.0.).}...?N.*.!6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlE......p..E..{5... .3(...~k..I.......[

C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	12965
Entropy (8bit):	7.055608395252377
Encrypted:	false
SSDEEP:	192:h4juQBzwQwAn9as+0aj6xJ6QU1VrjJwk10IUJBfvbhin6jCKt:h4jzBzwJs+0auXwLr+fJNby2Cw
MD5:	66CE205B39796A400AC3D8BB2F6BC879
SHA1:	8D43C3681850C22D927E5768697DE77F2CFA3469
SHA-256:	2AE0CE752AF74F61C13A3F4F3FD0025C56064F631C1D4030C4E3690850A58A37
SHA-512:	8A5DD047553B7934C972DC8223F95F84D049C27A25180DCECD9ECC8F5842BA3E3B8B52BB570BF9CA6324A066C0BD1E42CD250B5692687900A0CF58CBE3EBB892
Malicious:	false
Preview:	ULf..o4....t...3..z..r.^..O8..S....&.X.q..\|.-.Sp.=...d.:p..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{1e0ca225-d05d-cd0e-1681-94bd033edb10}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x....z!....h..8...$.`..J..b...\...\.(.!..x.&.cE<Nr...@,.7r...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office9CAABCCB-61B1-4B4B-8BEC-D10A3....T....&...8...h..h.Y..No.......8...b..\.v.Zj.%...K&Z~4..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X....C....8..4...:.r.]..Xl........s.H.j..z.'.-.3.=..}9djH../TM/v2" value="Office16MondoVL_KMS_Client"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://ww....e6....(...r...{.....W.g~...O.....v...j..+Px.e.#.j..._dUl\|..sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BA....."l...>......{.h._..H(.O.....k.

C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11928
Entropy (8bit):	7.10604207436874
Encrypted:	false
SSDEEP:	192:ALAqj8bpynjUr5WeVmLnmuYqEPShKMqZHHsppgZmenluW:AFj+cjpeVWfYScHygZmHW
MD5:	486C1DD2B502236CF4FE7C4F51FC2C50
SHA1:	634075F32006F8CCAF5B82874290CBC8DADE7E0C
SHA-256:	9F7548AC0EE1628C3575FD68E68D0C186830C664A54483DD88317C923245DCC8
SHA-512:	9C14376357C41ABB8BC7A3E05D2F1C6BEB6201594FD7C5D2C96B1ADA93FD89D7FAFE93F77F37836112F7B54976ED4CFFEA620E7D551DCE5DA3BA18612217742B
Malicious:	false
Preview:	..'.k.....-~.._..?.=..M1g...!.*;P;.....,.W..m.7....R.....K.{rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e682da4c-3514-43c9-98fe-`0..e.....x5.O...q.`...i+..N".r~."......n.^..%.......R.H./s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.....6....A...Y.!.)..8l....&.r9.y@.....~....{.d..K.N.W.5itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoVL_KMS_Client"]</r:08..8....;...^E.2.)....e...u.xkd#......3.P...x. ........W.8Possessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/20af..m....;e.N.E.O.R...h..Js(x}P#......)....b.u...n...F.g..lkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSO.b........A./}(.[.^.U.J....\|.8O.6....

C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9917
Entropy (8bit):	7.050258110781431
Encrypted:	false
SSDEEP:	192:/ZVotu13YywWoD9GWCXiflBA13T7W24mkhDGx:/ZCV5WM7zQW24mYY
MD5:	28A3DC92B7E047D1BB3AE68747054207
SHA1:	DE431A77B4B327C32B5CAF5BBC9A9F56765844B7
SHA-256:	C9DACC8B418BF9E1A5C12036DECB30139B1BC1AFED7ECB0563930DB29B6DDBC1
SHA-512:	D158D230F329A6F6BE1055BC98B72AE7DD1B0AB0525D77558A2CE67FB39FDECFED504DD1DE8D664DEA31F8E07D22262F41585E4D0C867B7CA8998CF7DCE53A40
Malicious:	false
Preview:	..+_..eL.>...pO.8.{.Qj.1..Pu;.&-..=..X.....6...(h..%2.kw.>...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b8382e37-c648-4054-b414-67....:..+..;..h..&..2.}..Z&8.~h..+.Hq...?.\|`T..O.=3I..s...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/J..Lf.El.g...o..;..o..>.:..Rz<.~/.{.Z6.@..i..$.c...`MNr..:....r:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoVL_KMS_Client"]<! ..P.eL.0...jS.j..i..p.0..Xpk.i5..)..`.M..m..pog...$G ;..#....rtyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org!`.S..8..0..jI.&.i. ..:..Up .%3..?...3.@..:..%.Q...q.P6......BcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWT....1..:..Vm.G..f.6.....w^..A<......:

C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10935
Entropy (8bit):	7.079132049563494
Encrypted:	false
SSDEEP:	96:1kmXSXQiZ1tggGaZl+oZL9EKv/S+1a2nGpI0JgRAhvpe3onqGOZrH0RBYPRujRMH:Xs1LRJ/B0y4Ouv9MOeWkL5JAxhUGl94d
MD5:	D941F4CD74CF2F1B409C2D5EA8290125
SHA1:	4822F83E220D49945FCCDF12DEA63B669629496C
SHA-256:	AAB71C4B5998630CC7AB09E5A2F27D6F3F4088ACAE3D4D86B3B747FF61C6E7BA
SHA-512:	5518668B1167C087EAC2B9620C19D5A61A19CFC7E3AEE6E62E5A22042BB0D6CB56D635CA468CA314BF152E17AEAAEE3D38788FB277AA4F65CA96B5D9A9CE77B9
Malicious:	false
Preview:	\.....H.lm..vX..7n.<.>.TD.z%.#."..K.i...3..'....SDu..0.e1..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{6a393a46-62c5-4b68-8336-.2n...@..#.Mx....y1.6.fS.R.pv.4..m....y..d..~...."9eB.C.(%...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.VG..h.~4.8G...)-.x.j._..x.'..fZ.6.)Q...=@.n...gS:.e.d4.../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .ex..@.ny..aX..+c.~.x.Hf.rrD6..2..../X...&.. ...%qOL..e.(%...s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b.O>....\|.."UE...[..;...nl.[&6*..%..+.`d....K.......^Rx..b.R$...PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4.eH..C....2g....c..?.&.kq.)89q...]...x.

C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	12900
Entropy (8bit):	7.065504633682136
Encrypted:	false
SSDEEP:	192:C2qwriARZnrassQwhsM0U0GK2lCYk/P+3PKHnZ6+N7Bt83xfIVI:C3wriAR4ssQ1MnnC//PqKHZZN83h
MD5:	98784A258BE71FF27CD43C905099A252
SHA1:	2D1FCBDF3EF95D3980BC7A1AF0348907CE4C02D3
SHA-256:	8CB3CB73E7D1644C0F52355F188E94D1483518C916029FF786195E71B583BA3E
SHA-512:	63D9949E6744BCACAD7DB0C4FE974831882BFD0DCE1AD18FB984817E95E1F9049300DA770E50BC3D5CCF17CBAA128E3279B2C1310ACD10F1EAF82B2546ED4638
Malicious:	false
Preview:	./..i-^...w.P..:`......q}..2.U..yEi...S........K_.@:...&p%..\:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{23fa6fb8-9513-f8d6-fbd7-cc10c25da532}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xR....\|8....k.T..."<.K..O "..f.Y.1Hoi.t.#.......]...>...nb(..E.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office2CD0EA7E-749F-4288-A05E-567C5. ..u'...2.%.P...k4......f~.`.R..lM0.......!...BE.X?.Z.d+a..W15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/XM^...E...P.;.\...q>.g....~\|.~....7.k.[.C..........@y.6.{.u.!./TM/v2" value="Office16MondoVL_MAK"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www.microL\|...r/_.&.H.a...*~.b.W,...f.....J0...].......A..Y/.X.8ww..[cyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-1655.Q...#sp.\.9.J...w=.M....,...f....nZ..X.

C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11895
Entropy (8bit):	6.991508769961011
Encrypted:	false
SSDEEP:	192:ZmJRFhy1rSyC+89nFrmJHsfpyuGYmCKsN8bBIOr0nrNjSlt6sV0y:ZYnhyzr8R8JHsfpyHy8b5r6at6sOy
MD5:	319AEA7A30CA86B8F284F9848B9315E4
SHA1:	9BF3045FB1676DA763D463B0148E79FB88742772
SHA-256:	72E1FCC0690FD71B91BC7378C1AC42D28023F8818E1D69898005493581FA5BC3
SHA-512:	AC3AB8160E83077F181E333540905259E9B509C430596F486659146D48AE87383929F869902D5368377342A364B6E0F6F82D88E4FCCDC5BC08871AF5E9472296
Malicious:	false
Preview:	2..."msr.....+.......>.4OMt?.&..>..3p...]..6I..9[.+...]/.g.Y.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8119adc6-de0d-4dc0-9096-..4.ob'f.....D.{.X..X..r.)E.w(.c.(R.#~..=..Zo..-.r..#...uWs.F.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.e@..(MS`...V.(.D.PB..5..MBs;.$..xb.1 ..-v..:D..j..,....~K$...itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoVL_MAK"]</r:anXmlEx.Eh..3oql.......W.Z..Y.?..GH:..v..5R.3...d^.^cX..8Q.<...-8.x.Y.or><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000/09/x.[i..=#=l......@.Z.A..?..GQif.E../o.r...c...nK..\|D..9...<.y.z.EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI449+Br.fj..9BR....7.N.t.Cq...bR@`,.n..(u.!.

C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20239
Entropy (8bit):	7.2453954884672145
Encrypted:	false
SSDEEP:	384:dYixqs+mSqi9BSg0EphG6eSl0K05nachnVdPx5ncdQkXGF0bBu6:dPqs+mg9n0Ep0VbxZVdPx5gQk1p
MD5:	7BC2D1BCA9A1799CA9F96304985E236C
SHA1:	80E46E4D9AF77E41E0698AD0A891FA0A4D67733F
SHA-256:	E05E38ACACF0DD4CEF65BC4DEE54CEE78E02971CEC2E985C69F4CA91F7F78F93
SHA-512:	94C42CFD5713A66F9581953CFEE0433300B7CB824DE6D6213E7565452493928C506A2BCB5B4ABB4EF0C9817EBBE19C3D5163D3B0108417292398BEB94E034074
Malicious:	false
Preview:	2.......A....y.>..=...7...?jz...._..$...q...{...[..._...".rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d7d7797a-36dd-4ef2-9f13-..>..D..Y.S..6.n..`...o...59y.V....... ...x..UG3..z..,....=Bs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..K.f...S..,..$.=.).e.>.^.=e}.V...'...r...k...{............~^:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16MondoVL_MAK"]</r:anXml..v.[......]..,.l....2. ...)Bx........8.."...DgL..F......."Issor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000/09..k.Z...B.]..W.f..r.y.l.-.?vx.@..D...y..%..It?..S.......#TP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI449+..4.Y;..#..R.[.P.P.\......:m.I.......

C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28985
Entropy (8bit):	6.737202301136195
Encrypted:	false
SSDEEP:	384:1fMqaVgQbh7IGfF67AK62pRFUNBUHJ29SBLPcOul/7dbayyRP8fhIz/WhjsAKxZ4:a1SGAA6/MtlR6PmI7WQN0J
MD5:	E8C788F1AED0D7260675F92C4A344304
SHA1:	5959F812CE5E2330A27E194AC54E2DD618614DE0
SHA-256:	86CD5F355D02EF7DDE452B179C65FD693C96A7E3E310DEE79B1F106A5785A692
SHA-512:	14596895D8570B58A6D347902BB01C3C6D4CADA6F982475994F3D1404A6148DB45FA9A9C41E43387F8A58FF6489F40B0F3BE44156CD8B826783DA569E8AF1E92
Malicious:	false
Preview:	.L.5.e.._.O....-....0.g....m..7.=.>.{?.P.........K...IV.H....:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{0e410b44-aa81-ad65-8de9-6485dbc3b18c}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x"..z.p..].S....w.J..u.3...7.;......E. ..............N..Z.....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office81D507D6-E729-436D-AD4D-FED2C..BL.+../......~.B..`.v.9..:..0.:.6.}!.......N....T...........15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X=.:;.I..........d.H..v.z.!..9..~.8.w.4j.@.........\..h!.-..../TM/v2" value="Office16O365BusinessDemoR_BypassTrial365"></editionId></tm:application><r:allConditions><sl:productPolicies xmlnsu..4.u.........}.D..a.d.c..i..X.g.../.=...P.QL....A...S..K..../sl:priority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C{.N1.(..=...."..=....&.4.u.F..;.g.4.3r.

C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	11989
Entropy (8bit):	7.047721821140573
Encrypted:	false
SSDEEP:	192:oNKC+3DnGyGliMxgXV9m7J0LkG9L5nTyRXXBFOl0ywI:oNOGDVxgXV9EuLD9NnTyRXSl/x
MD5:	4F4BC0367D782217D89F58F72E972180
SHA1:	8B65CFAAB83E69F41D4BA31A9FCDB59629374C0C
SHA-256:	842AE2035D1A94927B1685ED79E115B2699FD531C5BD1316290FC0FB4A36DCE7
SHA-512:	3409B2C6C550AF94DE494CF83F49F9F453AA61180F66CD48A7D789B502ECE73CCAB09E9BBEFEF6AE20272519FCBF130EA0B57A316E0365548B114D8396D5CD4E
Malicious:	false
Preview:	..q.>.Vd^...!.j..../)j...\|...C.+..43.....T.....b[3.......[{>.^rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{0bfb7ef4-f34f-4e69-8a09-L..g..[r..D.j.\|L.S.%x2...a.}.TCn.."{K.....G....*g........o=..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/<.Y..vv..0G>.&..O.kb>.._\.!.GC).LrK`....;....tP`........8"..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365BusinessDemoR_Bypass,..m...fu.R.r.jy.Q.g{8...z.)C..{..=lmA...TM....kY`........v ..d"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http:/W../...+Z.RZx.4....gf&...t.eC.tZ.17gzL...K....k@3.......U@...1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0...S.B.Z.';..0....m9...,p....`L.8.&tn.

C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28994
Entropy (8bit):	6.730272361846482
Encrypted:	false
SSDEEP:	384:ywIlAps7aiBujgR1P5RF5Ldt7BY96krcNUdD2dTHmwAFPcFEuR7UkjWmWdfsf2od:ZYXR1xRf7NYVo3FHFASef9uEU
MD5:	E03C3AE9C6506D5D1DA87C3F5EB1AC4A
SHA1:	CD0748D261FD4E42AEE500D0EF085AA9C0508E01
SHA-256:	1C89056201E369786B610C74C51F4FD1DD165EDEF644A05EECC89CBE2D4B9D4B
SHA-512:	1D29210678345C14CBEC95E78493DDE6DA4EF558C70704F88A5C36446068B9664F179E9ABD21C23260EF883DF7D2AFECBCF3474E11E15CC628FF32B8E6CC4753
Malicious:	false
Preview:	.@..)..._...<"......m..!.\=.P.Bk'.n._....i..].....t.b....1.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{ddf281cd-76a6-6bed-2e70-70f9ce399a43}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..h.,...]...8=...Gt.Z....~..i.\.eZ....M...m..@.....p.e.G..3.3.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office3D0631E3-1091-416D-92A5-42F84..0..V../...<....O8.Ow.."..o.WVE~/.h.......I........q./.M.Ru.!15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..J.94.......0)...Ej.Ym.. ..q..EG%n.!.......o..U.R...7.C.R.F..v/TM/v2" value="Office16O365BusinessR_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://w..(.........6"...xI.e?...a.y\|._..#2.l.......y...@...".c...]0.z<sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-B..0.'V..K...g~<..8.N!..".V*..E.#2.l..

C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11943
Entropy (8bit):	7.07405537850798
Encrypted:	false
SSDEEP:	192:M6E/746ELblGUzApyihtFC70mRJ+qhnvbHHoflMrG6n:Kc6kblG1JhBmOEnvsfOK6n
MD5:	C831B65DBBDD8A6D714D88D8560F4DDC
SHA1:	00111F1D25F8B41C3F08FB4B9501935F9742EA14
SHA-256:	853F9050F74A5E3DBF31CA58B9885F4AFC3041EF9FDB8D26383B5ED417D3333A
SHA-512:	CDF1E635E2F4316EE88CD52B3C15912546DA6DFF243C386D72BA248F759C54F2CA72EE0A97123767819CC5B036500EAFDA7F840874240BDC2C50E8E7E4C41C69
Malicious:	false
Preview:	.).b....W0..b......J.j.uU&.Dp....c.(.....7.Nn0.\.X1....t.+rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{794537c9-33e8-42e0-9df5-b.R?.....g....t...D....&.h_u.S(....+R8.....>..<x.j.2......w..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..+q..1................aTUW).@(..M.y@...d.Bc&%..O6......h.eitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365BusinessR_Grace"]</rk.......S0..b...E....E.v.s..+...".\|N....h..l%0F.=}......eyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2a.Vq.....M1.......d....R.vD......;F4C...U.DZ.A.m........C.rYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZS..Rj.....p2...A...r..9.\)Xa(..7....O~x

C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11491
Entropy (8bit):	7.132545104320634
Encrypted:	false
SSDEEP:	192:HKYO69P622GqUs/zmjyFBil0RoXAGB8nccg7p/m6:FO69SBGqUMmIB+Snfg7Bm6
MD5:	9B8B845CE10F463A3E22090ADF6B60CC
SHA1:	BFF70C606B16BBEF381EAF07F7BBA1AC2587D7E1
SHA-256:	03B71EB2A03E151EE0CC673EE95232409FDBFDDDF21A0F510D026FF72C807BAE
SHA-512:	22452968F8000E7A07BCB6ED7EE3C2A7D8A6F7EBC67B79EB518C0A243E7C7D62FD3155CA8BADAC2A26441AE9F12D2EEB66BE71806F371D80218378B633958F81
Malicious:	false
Preview:	..ZdD..B.H\..]Y..8.w>F.W.......\J.v...}....}.;z...S....1Rrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{3b44c9f6-820a-420c-9bcf-%..iO..R.N....O.g.}o...A........E\.)...?....5..S....mx......s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.$.w#.:P.yc......{.3u..............;....g.M...q.-q...s^...kT/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll 5.....K@.D@..\P..5.5&..u.......Zm."....A.N...l.%z...Gm...+.gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200sY.aT....DI....H."e0.A.I......]_.;....<.P...7..k...gZ.....rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV0F.+.....iC...P..^.0%..E.C.....U....

C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28985
Entropy (8bit):	6.710451089819921
Encrypted:	false
SSDEEP:	384:zszsOadkgdeKEGsaPH8d6kl6ANSfecOmQkSgPc5uOwzojSD70R8/mQ9tQF7905fS:ah79N+iSnYqjyF75Er+p
MD5:	059C49995F02F04658D664859ECAB52F
SHA1:	742C4BE241708E136010945934EE68BE8AA91175
SHA-256:	52DCBACD9E2F96DC6AC682530940084E2087E921133B8FF20957A0E3258AFD83
SHA-512:	0D66E089E538D2E854E02A43866F1E58D8B6C0D316A5432D8193CCA58043435FFA7AD6A002D4F0839F842676B6805C920C23ED4EDEF3E4732AEC3F7377C02013
Malicious:	false
Preview:	&.'..C,...v..>t..d..[."\J.U.3.+.....KHFw.WS.%T.1..a..`..@.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{55a23b24-f2f5-6497-c08f-442e1c1a5688}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.....V9....?..5...:.IIv....[d.$...c..;'.m.S\.8..}..e..Ar..E..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office742178ED-6B28-42DD-B3D7-B7C0E.W..........I..5'.v..A.%KI..]&.n.....NU=.wT.wT.+..d...K;..Q.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.-...o....9..9=.$..[.!SK..C<.}....Y..[.]..QC.-S.r.."...T...~./TM/v2" value="Office16O365BusinessR_SubTest"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:/....V(....c..3&....T >ri..2.......]....]".WD.u..!..~....4..[.y><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7."...p.....3F.bz..t..T. .U.P.7.@...]..

C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11945
Entropy (8bit):	7.054187124952808
Encrypted:	false
SSDEEP:	192:CNuKmiZBZYyBdzPY81KLiN3CD+VbgrBgFPfgKti:CsKRnXTLj1K8yD+a2FPfpti
MD5:	0158B821E76DB251931C6FF323217F38
SHA1:	22772619D4D13C67DE28F2C49373383307C669FC
SHA-256:	0F8F7678C38B081AC13E47309FDC6678F2FDA437549875AEBD736410F98AFC88
SHA-512:	AE1FED7EB8C904965D5F3ACE7AD33841FCBA19B0C9AF83CEC340B37A5A1998A4E7BBE746DA9AF0394EDB8B9A83D5BDBE6C01F00DCE760E3F9A78019C06C74846
Malicious:	false
Preview:	..B. .(..>.Er8.r...}-..6Uw....M....5l.F%..l6w.M..{.Q..`.....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{32c7d862-d468-4962-971c-me..).v..,..\|s..".q.w\|.zCj..........%b.Hg(..5d?.{..Z..+.:....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/....G....g.z.'..q.m.9f..=.W..........7<O.wT..`;a....\|.H..1.H..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365BusinessR_SubTest"]<u#..q.(..0.Ed".. .!.b}..7DY..........{sV.%V..`h0.N.;m..Y."....rtyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.orguc./.u..0.[e".l.!..\..=ON....N....b ...q.]=q.q.<8.jT.Q.Q..BcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrW....+.\|..:.ff....L..J....@....*.....s)

C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11495
Entropy (8bit):	7.086243549610733
Encrypted:	false
SSDEEP:	192:VC+e9IBUqqy77rxzOtHshUULPvS0J/B3O59t:c+e2p7kFsFLyu/pOR
MD5:	1340E7A3DA201CFFD98A07D7901EF6FD
SHA1:	86A8FFE7F7AFB48EC5FD1A2CD4D673458F7C97F3
SHA-256:	F6F8B0AF2CC58883AF760A6CC17C08032422E3A79DB86380E596C32046022CB3
SHA-512:	FB15DA67F5F9FFD492B4A5A20E22B2703429D4028EF4A2CA8C90D55A2EB402AEDC7BED19508FFEACC904537A0F1905927C9CEADF22EF503466C565E654147F75
Malicious:	false
Preview:	E.dE.A..`z...N`....Q.'.....E.%.x.:&...3..3...JD......:l2RV.....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c68369bf-692a-4f5b-bfda-.T......%5..../.D.E..v..V..O.&. .u?i..#..=..O...(.!...4.!.Y....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.b.VuK..r#...Q=...YE.l.....G.". .~d9..s._\|.....k......u1..L...../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .Q.7LT..bn...Na....P.?.....M.w... X..1.W}............&\|&4B.....gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200...@.A..$.....1.{.j4.\|.........!.#'j..k.PU...=z../....2u..]5....rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV....UN..1>...]>...\|5.<....... ....}`..!.

C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28986
Entropy (8bit):	6.693706342924464
Encrypted:	false
SSDEEP:	384:xXfRjN7sEaUgVBvw3UWho+N6IYSNBsza2P28PcbupWMmr6TdvzVIVf0fVQHkf3K3:xX7MG/NxYiBj2ce5KVfdEfiJR
MD5:	68642DB558A267D1D1EEE4DDCBA6475E
SHA1:	DB23F25C540BB9ED0F0B57B9E4B8B9A45FE865A1
SHA-256:	0BB2E14A6FA5C11B97B03A2F91771960783AD32D86387A5EF9FBB09081E73677
SHA-512:	AEE9D16CBAD0C447BC4885F49F7A50511D0B70E6A0BFC02573A18AA760DA453C3E86F1832A6540AE0E83CE7F64412ED0B170A2494FA874A89C5E6569ADC0BE76
Malicious:	false
Preview:	1..E.~!.b.n/.A..!C.T#....#.w.d...5;~.q......1.C....?..u.c#..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{ec9cc319-0f5d-6e56-315c-7ef387dc1724}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.`..@.kp.u.'+.J@.}.T.1^.w.#.h....;.yc......:......;..?.q....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office812837CB-040B-4829-8E22-15C49.5/.81'm..C.Q/.JI.uQ..9....".%.cZ..=bx.=.......j.C....:..4.8g..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.A%.U$^b..%.!#.FS...x.#....4.;.-I..\|91V9.......;.D...\|.....s.../TM/v2" value="Office16O365BusinessR_SubTrial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:.#...^~$..h.r ..D.}Bu$N@.....6.....q(zR"....... .....\|..u.,h..ty><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD.!+.9F>\|..2._pQ...RO.G?@..7.u.:D..'(zR"

C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11950
Entropy (8bit):	7.071199270813783
Encrypted:	false
SSDEEP:	192:0p+nhbh3qrTfIL1eejojPqERE+4IxvTG0IzPC7Zad:0p+FVqvfIL1esiPqEGsGzwad
MD5:	FD2C039D543EEF5284D9F538D0094BF8
SHA1:	283BDE6448FE056A246CB947252677B086172EE5
SHA-256:	5D3519B1090CC140FAA0CF4A50975A1ECF56700A9E3846AC1C685CECB3FFE3BC
SHA-512:	7FD38F3951E68100BEB4539F7F230305D95C6554AA61C74CFFB4BE552CB12A2F238CC624519C3BEA1F7DD364BC1A00EE909980267ECDC7EFF243CCCB804507CD
Malicious:	false
Preview:	-.LPz..3\|...g%x.9S..Y......MB!.p#.g.W.C....#...Q..~x....S..z,rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{9c7e482b-40b0-4b77-936d-...U ..l=..in7.i...S.PW...A6.5l.q...M....*...m..._O......exs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.5.C....n...;:%M:M...\....BE%.rgT!.#...Y..p...Z...yu.......3bitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365BusinessR_SubTrial"].H.V$..20...f)d.m..U.ZP...H@x. l.n..^..M..W.......es.....ffertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.or.H.\u..oe...x(d.cR..U.{+...E@3.lj/n..^.....p..\..b&....w.s"YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr.=.#...fw...E+X"g3..Z.m'....gn...e...VK.

C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11511
Entropy (8bit):	7.111605458712308
Encrypted:	false
SSDEEP:	192:qGTjLL+qo2qwUGQCym/ScuaaWBP+7EeIRme/D7FWEgIT:vTnL+q1ntT9RFUEeve/DBWEgIT
MD5:	9AD6462558AD3EDAAA2A8539048C4D69
SHA1:	50404F6F8A37A1067BA7B483860B5924200B4293
SHA-256:	D232E7903199C6B211E64142E8CCA0D29C45A128B46A606F3C2B48D6FCAE901F
SHA-512:	5E4FAE1A2178113BF1ED10059930B6EC904FE11603DC4A2BD12B11D96ACC06B73FEBE20FEEE8C93770B46D3937F448E98878CDFF2624118FDCA45ADB734573D4
Malicious:	false
Preview:	5.....v9......t..-j..J.y6...;..L..Q.:.....!.....9...2.V.IR>.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{46fe6032-3ccf-4a6f-a48a-.w.O._zf.K.....b.Zr7...5 ...8.....G.e...Y(........Y....]Q!.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.Au...V..P.....8..n~....rk...<..N....w.....u....2...\..L.L_d./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .rJe..~h......}.. k....e....i.....v.n.....v......9...&.B.DH$.gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200.<....v9......&.e]...<.{ .........D.w...>h.....(.....].R...rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV.#HX..^ .M.....}..K.....p$...>..Y..N.L..

C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	32952
Entropy (8bit):	6.81590169073945
Encrypted:	false
SSDEEP:	384:ksnrIfIECyDyXkgVwLbsTXMMkLASEHTO6knUe8mEuu6Sec5SuIm4bXi/Qf/65Rd1:jWPhHOXM7OTWUe8bBLoqG1L3LOh
MD5:	B6913AC31CA6978EDE97073D708221DB
SHA1:	5F09DAE2F297142934565F257A5146FD232C9B3E
SHA-256:	694C3EF8F18AA136E4E7EC8A91351213E863F17D63192C5E1890475FC6491659
SHA-512:	9759D341C16D636266E4BDCB54158599E4524070FF99DECB4C61D53BA81573EEFBAD6F18B5EF13DFD95DF7E0EEA532BF7901CFC258AA3372BF08F2F2165B5BC6
Malicious:	false
Preview:	7.V.b..d..-[.....m!...44.?E....N..0xs..q.(..K...e.P.o....Q..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c8b83b3d-b31f-8528-2395-27f4fe5732f3}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..Ig..5..:G....Pu}.....`e.k.._..i..0....J2..D....)..T.h.M..S...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office6337137E-7C07-4197-8986-BECE6...\|...(f.......Y<u...3#.>.....I..i~m..w.b..L......U.".G.....15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X....r..'@.j.....C&......7;.(.....K..27&.. .q..[..&...N.X..i./TM/v2" value="Office16O365BusinessR_Subscription"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="h...r..A.%@....X)d......tt."....26c..q.~..Z...1....,.X.....iority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845...~j.Iu.e..A..uy .....df.t_.U..W..d.?.

C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11966
Entropy (8bit):	7.044676001810928
Encrypted:	false
SSDEEP:	192:QAwbzIC7itNCC5MVs1JS4jDqyjCfIWUklg:WbJ+7Cc31coz8tlg
MD5:	A62936B70DB6339971C40D5303FA497B
SHA1:	4949A0BB9CA318031DC59D60FEF762C3890E75EB
SHA-256:	C197DA54C630091BC451DF77DFF6EB0FD308E34B22182930C0F264B0376BADF3
SHA-512:	42586F7F9B4CA80BE8C76DF6FEBAB6756F932DC4A80CF29BD4BB4B1DC00606DE8919766C5A1E769BAA1D37099C4CF56467BC6220DC823F2601E0CC9473676A55
Malicious:	false
Preview:	..6...R.qK...a>k.t..{.Tj.5....9H...x/Mx..2.z..99..-..T.[](.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{5ee06e69-7a4c-4ac4-922c-E.......?....(;.+..*M.&.(.y..\|...'?C\|.Ee.,....w..u....O^7.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/9....r.(z...<rh.7.I0A]aJ..%..;....-.).U..u....jt.-.4.....Aa.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365BusinessR_Subscripti........iv...v $.6.T6[.8[(.%..wQ..zk.4..9.`..'9gz.(..H...).propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.wN.......7..v=:.6.Zz..8&.....zQ...\|@.".. .(...=.2;......y.:.y6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRl8......q.3...\|b....^.xb72......X...sw]

C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26878
Entropy (8bit):	6.6269184640437295
Encrypted:	false
SSDEEP:	384:KCglushFlsKA2ut68E9qNLaPrntY4FPcYCuWDG9PWeWsvwRvsfGxtgVrKBRCIrGR:VCu8uVwqknR/tq5v1IaYRR
MD5:	79D21FA31017DCBD3E948E057D184AF9
SHA1:	1AA83BE47AD6977FA6E060D04FC848FA9B8CA50F
SHA-256:	1221D117515BD3D879827629C2EF18F9DC0D546FF3A57183F1DA9D8022AF3972
SHA-512:	AD42CDCAF68BA1F6F3D3E6BC94C1D9745FF0B2B5A75825D5EA11875B984272AEB7980032F50672DC16CDC8502AA062388D82B427D656D1974EFD355CE925FD31
Malicious:	false
Preview:	.H..#..f.U....!%A.] -`\&....o.l6\{%...J...@...2.\|0...a....#r...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{31bca2a4-2e44-0781-da48-f0f9e5e97869}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xg.7.&..7.V...>....~x%NrG..5.;:S\.).f0......=.ay....e...1....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office81E676D5-B92C-4253-AA47-36A0EK.`.)...s....-....220F7....8.y1.\|0...T...S..5..0....d....x6...15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/Xx...3..%....."...`T&\;....;.c..~kJ.\....[..".t7..."....F"../TM/v2" value="Office16O365EduCloudEDUR_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:%...k..c.Q....:e...!Y.1l%...4.XGQxcG....@...8.k}...."....l9...ty><sl:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-442O.a.,.;.e...{~E.\,#s@l....i.bh.G?.....

C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11955
Entropy (8bit):	7.028958713133936
Encrypted:	false
SSDEEP:	192:jzDmgsK9NyJhtzWgJyVQdja1c0COyShdgDaTg/DN3:jzCONet6gUVQdja1c0VyLomDt
MD5:	E99677DB5C810DE4BEB8BCBF4FE217EE
SHA1:	6B01825FC209340795DAB3DD9DD8BCEE8BFB2B70
SHA-256:	3AFBB9A2F2FA5D9C8E0669CCF7AED2ED02CA2760D2F416F5C0BFA267E30CA060
SHA-512:	D5787A465A6DCE6308FB3B425604CC821FB4ADAD4DE8514C7993B9308E86CD1C2826AD9BB162DC09E1BCD682871A91BFE487A06B3889922593547A906DFE6D15
Malicious:	false
Preview:	#...Z"H.[.....I..?p.Ot.pe...]..u..W.-J\|xp`(....x.CO..>...BK.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{419dcc73-919c-45e9-9500-....RoD...G..._EL`-..,.<s...^...:....=Dxv27!.[.D.j%..?M.2.AT.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..a.=(h.I.*.......\|d\. .{8...Z...1.P/./.-&"K{....s..X..}...^..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365EduCloudEDUR_Grace"]..^..4}.......TAO``.B&.xi.._...:....c.b2cu\....4.Vx...O".(.^W.ertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.or....Uj..B.....NO.,`.?..Uc.._...<....c.1znF{..2.u.ib...?/.[..B.YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr...k,n..P.....jKbC..+..\U..q...3._,.v.

C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	11507
Entropy (8bit):	7.099388989180604
Encrypted:	false
SSDEEP:	192:B6XcEkkAo50NdLOhaWRtQegWCkQW5nbb7bT+U:sXcEmmWGamtQelCBSnv7b7
MD5:	1C20C829A73FE8D8A4DE93510E5C786E
SHA1:	1BFCCD4A21D87CA0D3F4B06A537A97158AA6056E
SHA-256:	D046D7D949A1ADE928CFCF9963FB78D3816169792459995640781C14643D6D2A
SHA-512:	2F20FAD916437D4EA016D212907960BB3ACFE1EF492FC9B9FA514BD61C6D7DC18BE79B2BA506699CA5F7CE7AB3832836BC1FE22E48BFBD21A8DF02BC1EC72423
Malicious:	false
Preview:	....:.w...e..r..K...".......gU.7..u$...9.g...x....i........rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e499440f-f85d-410e-a199-.P..=.~.VD4.9].......z......?.....e...n.1...N..!.1.h....[s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/3dh.].W..RT..mO.H....v......?W.u...5w.[.7.l..#n....4.N....../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .WW`d.....i..r..T....d.......`..1...wm.Z.?.n..)f....y.}.....[gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200G...*.w.W.i..9C.$.....T.......>..6...-_.r...C....@....p.J...V.DrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV..U]}._.BOD..aL.N....x...,.....@.l..gw

C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26870
Entropy (8bit):	6.653873947487763
Encrypted:	false
SSDEEP:	384:rzkhsx+/7PT/4k2SyM+yiraZ6A3kLSNWP7NceMePchuu+vwVsH3Dnvrdq2zPdewP:kdbbNpFN3ZYHkTX5894Yf
MD5:	1EFE834D8CF6E98E541FD4EC3DD98D9C
SHA1:	4D83671846F0294A17268868601FD72DF5C43827
SHA-256:	F0854487346BC2796689ABC5C3D7434D2BA15066A29B536808665EEB639A7BCE
SHA-512:	9A3794E2FEB50382A91C4BA165F105D66CE0B02DC776AC1363CA6B54E534915F814698707705CB79F561C09F0833536E2525D19ED8673388A3F2DB48AD7EDFB7
Malicious:	false
Preview:	gDN'...t.L.:...f.....[e.O.....x..O.U..+.Z.6x.o.*.3.J.yUL..5.U:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{ea5c9691-16c1-0f7b-498c-cffb58a160ab}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.h...%.O.&C..<...Q.I1....A...._..O./..D.@.2w.r.<.v^N.~....7.L.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeB2F7AD5B-0E90-4AB7-9DA5-D829A...(.Q.8.j.h5..5.....At..L.L.........KC.-.....H=.#.,.O.4...Hq.^15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X...).4.7...vE../..}.[x.N.O...}..M..G.z...0h.g.a.$..0X"..\.../TM/v2" value="Office16O365EduCloudEDUR_SubTrial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="ht...4...o.W.+...=...[.TD......^....U..d.Z.-r.s.;.uN.D6@M..0.Rority><sl:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-...^.X.(...y?......u.Y>........d..+...

C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11962
Entropy (8bit):	6.9988864681266145
Encrypted:	false
SSDEEP:	192:Q+LC/YVyKMvejbOs91Lq5QTCYDeab77Xq6/dDiOEL6SgPi:QqCYMgXH8kCYSaLIjLaPi
MD5:	0733B072E9A88E0D00B736BDE6F06F01
SHA1:	B12EDF6BFF54A7446AE7C42BC05776A839AF4C02
SHA-256:	9862F38A6C06CAA29642AED8713ACE8BBAEB797948F7A2B744A619F24412032C
SHA-512:	6A0EB1F20EBE03C7394B98E8473F9BA9664056867F64841B966D3246F8CCEA9B4954CF546935DFBCD262304CAF85FF31973E0DDEA977D18A2F13AE4E72315310
Malicious:	false
Preview:	...H`.;.....2.`.-ki5i".W..fkm..+y{...Cl.....a..k....5..&%.. rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d8a1e50a-3564-4532-8f07-..Y@<.5.A..H<./.}%6hcsrL...l8n.On6b.b..Mh.....3...B..S...k1..ts:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.g#[.......1n.=..u!-i~.\. ddj.O)=9.R...=....l..&....,.wf.nitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365EduCloudEDUR_SubTria..3Hp.l.J.......u:+r6n4M..Udmq.Fe23.=.........L..3...,.uu.jropertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.Z..p.f....En.b.t:1\|z"4Mk..Igz.Keyj.;...'.....k...f....+...x..c6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlE.`.#.......W..=.w..x.MYB.."@Q;.iK\h.4..

C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11523
Entropy (8bit):	7.063691807450085
Encrypted:	false
SSDEEP:	192:X61wLqjY1fLmUZkODjy9C3MTnFLpl7Odh7ksU0LNhCko:q1wujmCUDKY8B7OdhXU0JhC/
MD5:	50A6E33F7ECD2056C750244BB2513C03
SHA1:	BD52A3827BD0001375239EEF3C6656FCE0803A79
SHA-256:	81A536E6705D7D1B02BE0CDCC3F5A20AE6C11DE11BE3A79E36C2626740F45DF8
SHA-512:	C04463CCA588AD48A13EA2B427769E4BE93BBCC9BB2B345059C7A82E9B413DD507EC27A35F980D9EFE131DEB1C71B7AABDBE860DBCD01C9DB03CED0D362EDF43
Malicious:	false
Preview:	....ef.....a...b@:.6.P'...L.$".52\...G.r...&...=W.(......!a,..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{bdd1250e-e919-440f-b078-l.+.m{\S....o@..2.e.<.........3z@z+JT.I.\|.(.pD..a.B..-.Dlu/..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/N.S..l &....=..a^y.r.....=.C. z.qp.a....=.q.-T..0A....3.. d!G./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll \|.l.;s.W...v...}\7.t..-.....1%A/4{]...<.y./I..:I.-......#l6..gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200:...uf.....1@..1J.c.&#.....,{R,3I...<...O..-...o.....'...zv,.rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvVy.n."i(....T...gI\.q.....;.T..^..iCP...

C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28892
Entropy (8bit):	6.717110095037584
Encrypted:	false
SSDEEP:	384:5h56D7UR1b8q/ub2zCYpcgC1p/AsiGmYanyGzjpdseexNhSvZAXEZ6vhxQ6HWG3j:1mSWq/uEC1HMyGz0qWpY3VJprC
MD5:	EC81B8DFAFF65D6288EBD66F4F51197E
SHA1:	EAA3D834C44B086C00043ED65A9BC3E44E32E28C
SHA-256:	C4CF71D9E34F740D7CFCD26FFB4F281684D49561AE4E8ADBE28A643D0AFEAC56
SHA-512:	EF8244EE1222FCBB2591D5A2A1CAD40256C575BC0582BAAE36EE6E18C9719863ED21BD71441FA896B05B2F4A7E96E76278D39BBB85CCA33199A36D9AA19019B9
Malicious:	false
Preview:	{....G(.F.}..!...j....dM..V....!#.C.0..$r(85....~.TUL..H.%:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{206375cb-57c6-c63f-8bec-3a44c28dff82}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.aF.R=.D.aM.>...6....0.....(....#.9.@.O>f,7>....;.POK`L.E.<.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office2F5C71B4-5B7A-4005-BB68-F9FAC.;n..~v.6./;.-...>....cZ...j...)z.].b..nn.?n....a.Q_.kF.....15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.@d..k.....1K....4.....gB...p...h!... ..}l.(?....i...m]Y...y/TM/v2" value="Office16O365EduCloudEDUR_Subscription"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl./@..O..I.xY.'...(.....eC...u7...u!.-.x.O "27j....t.LB."F.V..':priority><sl:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E.4....w.K..?E.....b...K.....7...(b...

C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11978
Entropy (8bit):	7.058734211115249
Encrypted:	false
SSDEEP:	192:q9wUAJUKRIVbibDweWl1EVhCFdA5yvqfx9dWYcWK1nr:qGJUKuFifwZl1EXVyvex9d8nr
MD5:	4030528BD458CFFACAF82E4B9776899D
SHA1:	3236F61870518EE0035C2AA797CA0CE59DC82651
SHA-256:	EDD104FE67169C2B5348C57458F16324C5C9F5BDD18A82EDC1C6AAA19EC57162
SHA-512:	5E336A90214CC18EEBCF29D9FD585BF4B845EAEF5DEAAA067E6C55BAD26EA544C5DE90C79410CD9C4FB1BD7DFBD4BCE593795C421A6F0E550CC3866E9E15AF0D
Malicious:	false
Preview:	....+[..U.(.z0.b........6vE.\....tje.7.....C...../...F.N...!yrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{89d09310-7a5b-4612-adfe-(...q...@G+..1..2A.H..J. kOF_.W.m\|-.'.......G.Y.......=.g.>-s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/\t.LQ..G_...em.a...L...kVG.[.W..6,..5.W..L.....b..._...{..h7itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365EduCloudEDUR_SubscrihR..z...Z.w.K2..U.I]...;'.S@.T..A`$.)......C.............7.p}<r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://wwo..:L..ZB}..<o.pU.W\...w'..a.y..Vm$.p......C..J..#...[.9.-.. .1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsIt..lv../#...'f.._.j_....J.:w.p.XO..r.

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28176
Entropy (8bit):	6.70146791677382
Encrypted:	false
SSDEEP:	384:n1lhUUaM7L425XCF9QoK6ASaNUF/cAPdo0YMRXc599uLiGhnXGtAdiU4wWzCB27a:3htLFkfcBURi7c2aixfZCJbsoHh
MD5:	4148713A8085A84613B38FD78E5A0E7C
SHA1:	938834577ABAC4E48CCEF41C94EBC061D2552BBB
SHA-256:	1193357CB0A85338E0E2B7C795246E12E9843126C40EB440143B88CB46EE02A6
SHA-512:	8035D71EAEF03AF6AD8AE4B6EAE0B45658508C004BFF856429ECE845CE68F1B166F4639940FB2443A692A1087B71FBF62E5425B86DDA12D9E94A0B3A7DB8211F
Malicious:	false
Preview:	.`r..<..r.....3.:..!....!..6M.L^Y.....Y....>..U:.$P$...c.(s..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f7d3eb40-04a6-1ce2-14c7-cd798edbc795}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.....)..p...E.8."Z.t...T~...aA.kos.f...6....1t..,.a. ...+.%q.f.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office7AB38A1C-A803-4CA5-8EBB-F8786Q.........3.8.kR.>...."..#J.KKQ...\._..?9$.U3.;H!.B.!.l7.t15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X`.......$...C.4.qX.X.... ...9..I...\.X......u.Rq.3Pg...>.xK3#/TM/v2" value="Office16O365HomePremDemoR_BypassTrial365"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns(....,.."......s.qT.~...H-...."..rM.g...)...Tc&.Je..T'...h.86O-/sl:priority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C&....q......=.k.)..$...^\|...oA..YS.[.C

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11989
Entropy (8bit):	7.041066892293144
Encrypted:	false
SSDEEP:	192:86X7llPVc0MwDZ/SeL96hky+2GlYURcm5nactATuZDF5m9bFk2bPF:86TNcRwh6hLlUem5nFeTuT5mfb9
MD5:	5B1E1356A46B8131BE47C6EC0AD15EA4
SHA1:	064A7470B82202A978E74170436FABE91A850A96
SHA-256:	632BF1AB9A48C192307BC626CFF9AEC99344AAC27BC6C888BA19803F69D107E9
SHA-512:	B1D5F1DC56F8C61651A594670539CCD951E386AD509F1B052830B278CC415B8B2294141F9928555D75224A77C068D5E1F8D3442BB68C3E00D157642EB799ADB9
Malicious:	false
Preview:	......@W.C.....!.._y,..u.(3n.B.)..~.f..w.;....'J....%.j.Y.\| ]hrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{902d5598-ef0a-4c7d-9adb-{.n$....A.C.J..q...U(tT.c."`m...f..6.v..y.l.)..ov./....T...h#B<s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..E9..`E.r...."....2x..(.<i...m...d..)...p..1A.K.(.s...?<.&itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365HomePremDemoR_Bypass..aw...U....R..D....+~..e.#4>.P.f..!.(..w.f.\|...H.....w...q>^;d"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http:/g..a......A..X.3...6`....ox>.-....*.%....`.\|...Q.].#.m.I.G.D<1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr09.{G..T".q..'..(....i]..[...S.9....k...

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28237
Entropy (8bit):	6.718111308618164
Encrypted:	false
SSDEEP:	384:bynjgUCkLFI6YLhXgiG6KCNmjDb+CPcsAAq1yONo/TAcrg3tyvehU5AUqcCWkvE:b2MxxgKKSWb+2FKNo/Bg3ty2uupE
MD5:	77670A4FD30D672FC1CD47AB2BA010C6
SHA1:	C92D8289164A6F352D7396F23EE2E8906EB66C97
SHA-256:	10799E8BF096752B7522E0FC2EF1223BB440743D37D0D7FE84CA9DD08385FA2E
SHA-512:	69D646DB853AE2C9413354F0076A2482116DD1978BF8CD005254837354792F4327BD688F3F3F4A8A59A46F1504D77EEB4DDA8C41A313E7B758256AF0EB1622F6
Malicious:	false
Preview:	..l..h....W...b.I.).X[.....zc...K..N...o...G\.G..(.=.)."g:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4ff34008-cee3-1b24-ba4b-823b1f88a1f4}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x$...}.L.).K...8..G\|.J......Y-o...K..\.....k....J....2.w..$.'~.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeD7279DD0-E175-49FE-A623-8FC2F....tS.Qr......1...6.BJ...._od...........O..GU.X..".\|..m.3l15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X;..D.^Tn.....+..YP.XF....Au...I.......i...@..P...J..y..;/TM/v2" value="Office16O365HomePremR_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://w>...[s..Q3.Q...p.*z6..s...Lkl..................L.6.n..b.)7<sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-B....&.D.......}.I.6........T0........

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11943
Entropy (8bit):	7.044715184037496
Encrypted:	false
SSDEEP:	192:N9bysRq2Ur9laStgdUPR3CobIAruHVmPJj3d:NZyUfFUpy6ruHMPJj3d
MD5:	EF15448B0DEB8EB9222BF102DF1DB047
SHA1:	C4866A6596575067A2FAC2B9A11564045EF353AF
SHA-256:	A770F5555406096A933950DC06B7A90BC12CB85D7AF0F55B9520FFF9F42E8BB4
SHA-512:	80B2367C4EE7C819E55210D965EDC40A9B3BAC7B25384CDA6C86AC73973AE70D377258046C91EF22A2E856CC7AA60515B76882B2700890B3D2B58A1437749E0A
Malicious:	false
Preview:	..I)29..<2g..n.y,.\.......x.j.z...o.yZf.`....fd`....3....u..[..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4d25bd9a-d6ee-49c2-adbe-.l.L$sd..~f#.M!.)b.........r.i."Q..y.&Jh.n..?6(......I../..X..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/._yZN8...e.X..3.z2.H...._.z.m."...)..X6.>...jiv...4....$.GI.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365HomePremR_Grace"]</r.lZ-{&...82f..n.z2........".v.!Y..e.a.8....-fu...........P..yPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2.=.Z&s{.&3f..".z2.!......i.:..Y..e.2F5.5....lPJ........;..l1.YlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZS.D.A/a....0Z..C..=.7....".L.^.=...p.;..

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11495
Entropy (8bit):	7.115343312049285
Encrypted:	false
SSDEEP:	192:HvEnERylQZuaE/f+X19YQy2ntIUuUISbxJ+g0MM9h:HcE8+ZM419YQxt5uBsLf0H9h
MD5:	5C5875899E44DFA0B21168B8C99DFF2B
SHA1:	CA5E98FB187448692AF0D971B64B2D230E6FF91E
SHA-256:	33DF3515C28FFD5DF6CC978C9AB085FB5F4E9DA1014B05400E6D20301BAA287E
SHA-512:	1E68DD36683D05ECCE636102747B2A4009B916CEBD912395B43FAFADFF7D27862B44B25694B957DF1A59ABC6160C10BB5CBACC7055BB0FD8CB33B539152D9880
Malicious:	false
Preview:	O.q.....B..V.......=.\|...I..B.@7l.u...X"D_^.zIR..`.^F...u.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{840b7bc0-5307-457c-a063-......!...........e.0.........Y!$Te....uM...2ud(.A'.x....v..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.........}.......Z.i.w...F......q.F5...B,.T..vDD..w_.f*..x../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ........^..W.....\.{.`......E..F.-_w...d$.V..kNL..s.NR...o..gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200.........W.......K.K.~.........A".F-......{n.0rj..`.Gr..../..rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV.....7...]........Y.g.u..Q.->..( }g.

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28229
Entropy (8bit):	6.673819599345775
Encrypted:	false
SSDEEP:	384:6bsLMnUc4dFtWB8eIUpvlN+zGTuJMsPc+hovYvRZb7AsuPAfWzl4K330YeFlHEq6:VzyNVDVTuJLLkRPR+HY
MD5:	F9654092747D405EBAAD4574FF6CC52F
SHA1:	95A490EB1B51A562CA0FF5A01AA59E11E1BD3AFE
SHA-256:	13C2EA2B04C2C1F1BC9B330ECA9EE1EDEC9AB1D008309658629739322ACA3F3E
SHA-512:	4F756D81C4C4CB71B950D131F0DA374670AD49877EF2376F29E8A7DCB7CB394FB74C49A8DDF972CA9C62BED1EAF3DFD5EC7B5B86521BD9BD434EA810AA121C0D
Malicious:	false
Preview:	.....h..E..;p.!.....y.Va&.^"..d}!.Is:..D....(....'/.g...f..#..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{0df015f1-7beb-cf67-3fa0-ebe78531fd7a}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.Mt.}...F..rt......<..5w..xS.hr..csO..4k...'...kjMc.....!...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeA96F8DAE-DA54-4FAD-BDC6-108DA..(..'...c0..p....).Gf1._uU.c8&.A*<......../R...=0.b...$..g..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.lV..D....V.t\|.&.....?.Kb).IvK.-+$..qu..TU....8...d8.$..;....^/TM/v2" value="Office16O365HomePremR_SubTest1"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:..m..>...A..'..a.......W7.vyF..p"..`>..@H.."..7gS$...d..9..ty><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD..X..&..A../.w....j..\|).J$..:&..[`>..

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11949
Entropy (8bit):	7.0780182584962
Encrypted:	false
SSDEEP:	192:e+fRjaQmmJXlgxci5rWfYshiYoJJ9t54dVSfO:e+JGmlSGi5+1idT5E/
MD5:	8E350D1EE7F4933E506EB9E572BDBAD3
SHA1:	E86F49788C90BE5598FCECE14B80FA5A2CB12453
SHA-256:	E9CF57F2CA5E6DB910E37CCC57B178656BE2C0C8CDECF9E954E84B2F61EBCC53
SHA-512:	E980AAB82148E1CCEC3F5AB69691C462F46B91B72F56DE71CF89C5521C836D5284F6F26220DA662A38451E7AB868ACCC42D7D1DA1BD04D28730DED649A2A57E6
Malicious:	false
Preview:	Y..j..p..s...r.3.......`Vx......N.8O..O}-ET=~.q...W..I...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b4a1c2fe-2a11-40d7-a070-.k.7...}..6..dS}..G.....j.{.v.......6K...t{..uB.X...i...]...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.\.y..P..L...>.-..].....bY..v...S.:.h.\.d."IY+u.<...N.......itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365HomePremR_SubTest1"].!.l...q...q...oW~........ESz./.....7.kQH.Z. ARe2.d.......U...ertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.or.!.f...,...l...uY2...f....R^z.v.......r...i.w[o0s.[....i..\.YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr.T....%..3...Q]S..r...\\|T.t..\.O.c

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11495
Entropy (8bit):	7.088868367821106
Encrypted:	false
SSDEEP:	192:pTO/jHmiAvcRhiD+30/Aq+DJq5CCUWyDRSDQ:pT6jG+Dii3Q+DJICCLyDRSDQ
MD5:	4F52A620E2982962BCBCF8AA56CF2233
SHA1:	AE9996DCD611E212E8E8FEC9EEE7CC71E04081B5
SHA-256:	ABCEFCD7FEDF6C3E9699531D68AD24D592427CD22A6698AFDE90D1DFD2680567
SHA-512:	37696E36759A836F5FDBED49DA0B6B517009937F869B90AD66A4513414CCFAD33947F3A5D6516216449818883AB732F6BE93E7B16E8E4A03735B66A020DD31DC
Malicious:	false
Preview:	5....!y&.......N7W....n.$.i../W.q+.....pEF...X.}K.vSX.Y.d-...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{82810b31-28d3-43b0-9283-.....N-q1.].....y....6.2.c..8..>2.....~.......A}..ro.g..)9..[s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.. ....Y4..%...M).....g.y.k..+..5i..\..?_H...w.p].BD..y..e(.../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .L...)($.......Q+Z...d...a.T:P.k-......>y@.....zU.s@D.M..f ..[gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200..]...!yb.....!F'....j.2.3.%'..h*...D....v.....Fs.YSP.m..E6..DrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV......`w.......K>1....L.6.9...+.Tp.....

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28229
Entropy (8bit):	6.75286933099627
Encrypted:	false
SSDEEP:	384:Idj8iK4UGo+Lg8IBzQGgIGFTnyiN2m8HuhoPcdjRKKA7JXAn4fmhLRiBKXnmh64W:y5KSbIBUDNnyyagznxXiAmi
MD5:	B191B4F613DA5F2D55BD79550AAD3EE0
SHA1:	7B4B26C9D66F2B7F27B5B377727A7E6A12FD8259
SHA-256:	B2B63BD46BF6C9EBF1AEF688B38EA5728B69C901FAF904E79B8154732436C2E3
SHA-512:	A38AC9EB1BB7DE8060FAEECC8DE8F69607902BC00838F6F3AB858D6F603C0923486E6D699F16C2C22D2FFB50F403753343551DABA63C29F4BEA702367D82E717
Malicious:	false
Preview:	?a.S.Y.W.......X..Y.......g...h....~H....l{...9.......[N'....:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d424b7bb-edc5-a05b-d1bf-bcbd40ccda9a}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x....L......S....F.SB.8...d......2..e.vo...$_......\.o.....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office77F47589-2212-4E3B-AD27-A900C..u\.....;.....S.....S....d....o..&.xV....&g..@k........e..\..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X...].u...Y...._.....E....f....!...g.1...[.5e...1.P.....z9z.. ../TM/v2" value="Office16O365HomePremR_SubTest2"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:..3....R............s.M .E........j.z..F.?x....[L...DN%....ty><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD.........^............M..2...6..<.z..

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11949
Entropy (8bit):	7.090373559192869
Encrypted:	false
SSDEEP:	192:fdZID2X9Kh/PsSPKbeLfVyyrpuXIfWDaqtnL3wJz:fdZIq9K1tCKLdykuXsWtnL3W
MD5:	183B260D203E762B31CACB4591331251
SHA1:	BDC8F9FB780D6FEE6894455BBBFDE872FD42FA81
SHA-256:	144E88219A4D8F75091B8E5D937D680FA149975AA9E5C57DFE43A8D664E43DBB
SHA-512:	8DAE11E6B44C8D44601ADF0E5D71E2E9E3E04CC48BCE35561B08ED88850254D56713D2D640E8E4891978C09BFA182A6DB0392E2AB28F31C5390B313CA03BE354
Malicious:	false
Preview:	7s..L..3.Tg...j..S.i...[......c.... ..Au=j.8.....]plER.X(v.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e943c591-f4c3-4e63-b6c1-..8....%.W-...\|...c..........;.......O7jcJa....\|G4{!..<)iGs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.....F..!.eX..&....-...P......;...T....'.9.4......Z}u\...k6?]itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365HomePremR_SubTest2"]..+..Z....Ie...w...e.S..7...b.....YL...f(..<....F{;.N..46jYertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.or..k....Ix...m..@.e...~.. ...;....mL..Ck.9F&.....A.k{C.\|=r..YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr.......8.C'...I./.j...w....:.9.....!Y.

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11495
Entropy (8bit):	7.098816652649914
Encrypted:	false
SSDEEP:	192:04TBJAww7rSLDMgfI89TvZUtBli2FR1hAkl:ZTBJS7+/MK9TRIn51hxl
MD5:	12A89260D228A97992DF3F5A263F646F
SHA1:	96B876DFE4821B0A8F8C59D2EF31092030F896D1
SHA-256:	72A7AF70A187E6324D4CB09557485DF415D06A34782300A840F5D2673089C8E4
SHA-512:	9351C92E0C557D0830A472E2566262459914B24F1E9146E0037823CCA16B2C8002F5143E438E29D65E70DA424816F00766A00F7A1BD4A58052C973933EEC93AC
Malicious:	false
Preview:	I.Cs...`.=.m....i.q...!..*I..<^.......::_.7N.,.......~...W...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{71585867-7cfa-4ec7-84b8-.~.-...:.}.y ..'.,..y..7C..+......q..>4.D>..~...1.-..@...C...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...`..@.d.Rr....w.eR.(.Z.K..8..._..c..muE.cE.....!...^...R.../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ./.....1.).q9...u.pT..+.%)A..)Y....z.etc.`G.m.......j..Z.gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200.a.v...`.8.x~......C.%.. ...4....c..b\.#~j.{....:...J...L...rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV.~.<.y.y.r....`..Q........."..F..X.

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28229
Entropy (8bit):	6.644369539881968
Encrypted:	false
SSDEEP:	384:fq7IUOMhFjQygN9x3i0NCJzf/a2PcVL3hEJlUwjN7/wfIfuF6BKHQRpYgYR:mR07jtisCd/gizSfJ6R2x
MD5:	EA37B7924FE0649DDD8996A1874707B2
SHA1:	014658889612D82583690822945FC1F06C82578F
SHA-256:	F03952E2E449CF0F868ACE8992AF80DB73245E151A90176DDD94999D6175F3CD
SHA-512:	AC84866D452C0AB676255974DF10EC6D16293F2A5DEC3F414C6AD3CD3E0739BAB921F75FC4B46EF19DDD3ED76D51FA12605C5F794DA73DAD4FD223196899B287
Malicious:	false
Preview:	. .>\9...g...3..4.4:..R...4d.p..T.5!D..M..u.s.....id.<......:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c2b94d81-78a2-b696-a524-0373c3a984b7}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x...qY,.Z.d...7..n.hd........n0.....~.@[V.....q.x.Q...m~.v......microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office96353198-443E-479D-9E80-9A6D7...3"x.G.A.C.3..g.`(...C...c6.5..\.3?...^..U.(.....ln.}......15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X...0L..H.#.].?..}.jz...O...`(..&....zt...V..s.y......N.K..././TM/v2" value="Office16O365HomePremR_SubTest3"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:..u.o...c...<..j.h;.......o%..}....1p..M..n.b.U....y.<.....ty><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD..C w.V.$.W.lW.;.G6......2f..+..F.1p.

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11949
Entropy (8bit):	7.102889642247314
Encrypted:	false
SSDEEP:	192:zXOs8kiDz4R8Bn1tA++GoMKLrM3dkF7zTF7VzS:DOl5zbn1j/0d7N7hS
MD5:	38C45D7EBBAAC071A57B41EC8D4E156F
SHA1:	A3FC9A55017C577937097FB85F9B502D8621664E
SHA-256:	230C3414FEDBBB8CE0B6DD1C3701323E80EF07E6F072538A23269DD6AB19B935
SHA-512:	DE2405C1701218E3116368F2D9C1DD15F4CE5EF0F1804B2727B135C6EB2B877019CD904766027B2082A7042B798F818AC3EDB762121CEF85F81F799BD8036A1F
Malicious:	false
Preview:	3..O..\|...?+...54...S.......8/..f!....p.B^(.7+37..?....'.g...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{2bf6de92-01ea-4f41-9987-....u..?l...#d._.Y..O...G;8I.)8.Y.~...!.ny{....L.c}.s..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...\.\....C..y7.C.......?+I."c..r. ...u{.;&%<...8...Sv.$..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365HomePremR_SubTest3"]...I.I..")...(`._._........:v..)3...#..QK\.3-k{..$.C..-.{..ertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.or...C..>.."4...2n..._..&....:=I./..K.:..\x{.).>:...#....>.r...YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr...<..%...(k=...j.\|.P../...>..K. /....+

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11495
Entropy (8bit):	7.083493127071544
Encrypted:	false
SSDEEP:	192:IAXkteAWl7x7sBLeSl9ASVNTJUfYW7aoY/DFA:9XoDW+/KSVjzW7aoV
MD5:	EE895984288AC57CAFB80454BEFD8F9C
SHA1:	44D2D901440A52B2085F18475DF40CF14963DD84
SHA-256:	C89BEA131B65F78B604D8021EFCEF0E6D63AC5B9C6B5ECE5D52E78F682E50772
SHA-512:	644B8A79F95883447B22AC045FCC4FFA3D25C1E299CC980A66C62BB03F6CC33F348C72DB7B9405C6F6FB2AD3B0E882EE625C2EF0436DCAB676A289D70F673A7C
Malicious:	false
Preview:	]A.....r...&%.g">4..Q".@r.#....f.3.......P.q2.L/.!..~8....Drg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8c942012-6bad-4f6c-bc8d-..C..F..c...(n.qrpk..U.z.Vo.p..T.)..{.........#z?z...2@@K......s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..=.w...`..z:.+! w..O.+..R.,..T."..N.O....[.^>.Z$.6JE^m....B/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ...N...p...1%.n="9....(.bq.t....\|.r......Y.0#.R/.2..j^.....gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200..@....6...vn.5MOD.._'&.Vx.v..U... .W....t.&x8t>.!..Ji...S..rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV....W..#...6.n'7R......RT.;..p.C......

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28229
Entropy (8bit):	6.765414546219833
Encrypted:	false
SSDEEP:	384:3xDoeGUwkegiwNQjfnR/mebNAJXKziq11OPczXgVdtMU1aPcfeze8e7KPvtwvlkw:32ewb1fnlmehtziq3OWPdi8fOCw
MD5:	3A1CB0EF1C2A7A5CD026906C35959FD9
SHA1:	92FFC6C174DFC5B4456E341B18009482C3D1FDA3
SHA-256:	A4A49A428C7947D8632E81630BE925E199429E1EEEC44447CE57D323BD1E5D56
SHA-512:	BDA8DD2137A9BF9306CA8EA4E80154AEA12A9A755020E4B4016D9907CEED00F7D4D17424401B194DAD02F0B73AECDDD6C29BCF8A7BBE40AD7EB02953CF2950E8
Malicious:	false
Preview:	mo;.=9...........c...5V.tKv~..>.....M..G........f../......:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{aec114eb-c8ba-2844-d12a-860803ec3a81}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..Y8,..........=R..a... .")......`_.e......Y..#..5....}...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeB4AF11BE-5F94-4D8F-9844-CE0D5....4y...._....V.q...$Q..u.$k..9.......T.......y..%...;..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X...-......A....L.#~..(U.c.:q..;...O..[\.......q.G.....G../TM/v2" value="Office16O365HomePremR_SubTest4"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:...]uo.......J.bs..`.\.7J.=....K..FG...]...G2...e..ty><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD...kAw....K.......o....K..`Mtp.......K.

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11949
Entropy (8bit):	7.09517386169584
Encrypted:	false
SSDEEP:	192:e8o6CXmpsEvM8ofEj5w3RhYrjzYBX7QzdfNRowgy:e36CdEU8o25gwrjzYl7Wf/T
MD5:	09D954BEA3CC49FF75DDC05CFAA17ED5
SHA1:	63F0F4A5D7AFF6C87A5F09CBA1432B98D500AD8A
SHA-256:	53AFD55DAF5B0C9E7A1E2F25666F7BE10C2CDB1F7D8FDEE74B532E561EEC4749
SHA-512:	F1F4AF79784B446347E33A74471C8E3D166AB6599D65570C8EE7DBFC135F0E37A09F30C65D7FFE28A70EEFB46693BABA97463BFA17724DE01C6607240E146ED3
Malicious:	false
Preview:	....."@\m.......N.1....6.h.......<.!.#N....pW.V...44.PB.....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4b21847c-ef10-494d-b71c-u^..m..{........l...z.u.....E..*W~.-J.....)..j#....Tn1M.....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.n...(`\|........P.%J...=.H.......zgU.s.V...\|Z.]F..39.I.F.V..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365HomePremR_SubTest4"]z...4u]!.........!...>.u...G.P..5@X.pPB..tQ...../?[.^......ertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.or!....j..t.......O.!......~.......5Vl.i.....nl.[1..(j.nS.....YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr.f..n..f.........L......?..).x..ud .x

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11495
Entropy (8bit):	7.003470079889445
Encrypted:	false
SSDEEP:	192:fnJ39mXaWoME01YZj3XfV5ZeKUKDWTtqZvnv9B:fJtSX3YZzXdbeKzWJgvnvP
MD5:	39EEE5712BAE44D205374477B1E92F59
SHA1:	DA82A85094CA8AB95052D59948DACB382572E33E
SHA-256:	83695E1C22F3E520C98083DA79C86DFD7314278DA36B1B2E57B1D60F1809AAA9
SHA-512:	7DE0914E0A8C1D381EDB82118C98C7209836B28A73144158291EE0D74088FEC1386E421C86E5780B3B37C7B69DED36382D772E0706FF711699D9FBADA7D72BE0
Malicious:	false
Preview:	I.....(:....j.f..T.zc..c.Vl.}H0[\|E...3}=.^mPK...v.F..;DG.y...y..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{6cc8ce66-cf3a-48cb-9e79-.!....rdD.W.d.)...Z'i..;.@q..K'.9....lm3.P/.BK..>.p.c.s...O..z.+s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.K..s.....5.6.;G.JFn'..j..L.rO4.~..[.~=n..w^....z.P.=,...,...t.y/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .x..J. k....}.g..H.{!..i.to.*.%\8_.:.g.t..QV....g.X..(XW.....c.+gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200.6....(:C...:.7Y.%u.6..g.@f.(k8.+\...~%F.8,`.9.<.~.&;L^.(..#.4rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV.)..S..#V.%._.8..]c.$..A.DJ.eM.'i`...Eon

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28229
Entropy (8bit):	6.648467651945843
Encrypted:	false
SSDEEP:	384:BefZT82UJdC+sUrEelfrmKOH5Y6yRNY7p9tkSayPcEkWK58o074cIf9UShtoUKbY:Mflk7fEeJmKOhyfL+RLNctj
MD5:	64547D84FD329FCC8DDFD06212919FEC
SHA1:	9D06BA6CEAF591E908A70566FDA9368E0A7BC768
SHA-256:	F7CC9AAE18E07BF35E991F6B3A95B7B9D6069CE349D7CF6F0809738B4891025A
SHA-512:	43C0A457DF405C8C5BC68982FB7E07D504C24361961E5DD7CEECF064975755E0869846D7E99030FAACC1871662149D75FC549132E04A91F35C53DA05C15A7BEC
Malicious:	false
Preview:	.,r..{.9.....vt..c....3.pf.....u\|R.. ..+P...X..>........zrl.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8a1014e0-11d4-17b0-4121-016b80bdb3bb}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xgU.=..n.;.....i...?U...CgZ/2.K...RMx..}2...1D...E.irX......wpi..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office4C1D1588-3088-4796-B3B2-8935F9x.... .I.1..z...7.....4.sg.M...riZ...l...aL.....v$....E..Q>6}.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/Xxt.\|..[.o.W...}s..=K....0.qq.S.I.p2...Rh..rN...P.4}..V:).o*JR./TM/v2" value="Office16O365HomePremR_SubTest5"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:%..9C.{.z.....m4..?...g]..RN.^.q.v:...Vs..xS...O.(.U.V....E1hl.ty><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD=...w.;./.@..)"......]..%r...^.If@..Vs

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11949
Entropy (8bit):	7.027818466138272
Encrypted:	false
SSDEEP:	192:rCBNqLyRgaNGfahcxwFuGG2WbiWBUWmUlWvP4at/mRdhUf+:rCWWGnecxRGydDFat/Bf+
MD5:	4007F55965E16C2CE4E3F29663FA0EAE
SHA1:	BE539C94F6297CF8708B632327F035044DAEFAC9
SHA-256:	7D12AC482B47743FB18714BEBCF3BDE5EC970D2C3FE0310B302058DE1726F07E
SHA-512:	1CFAE9FE512179F93BC23B5E3F2100862326D282C6E42224F32950845E22A14C660F0C49E632017EEE648636317A06A574122FB692DD8ABB61B0D5642D764F44
Malicious:	false
Preview:	........b.?<.F....^...x.8K7...Q.'.N....oGp-.`-.36V..c.!1..t.Jrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e21be54b-1cb0-4970-96f2-y&t...M.%.y2......X. N.V=F....h.X....kI2z.6t.{.`.uBy.v.9....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/......8.;..`..E..JEB.q.ek5.....cD....>."..o!.%=...d.8(F.%....itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365HomePremR_SubTest5"]ql3....Q.==.Z..N...'.4V....P.h.G....q.c8.m).kzD.(x.v...#....ertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.orls...D.;. #.Z....N.y.\'>]......n?G..."En..:3.>;r.2.C&...P..DYBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr.......M.V....f*.#.m.P....?....a......

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11499
Entropy (8bit):	7.114690660447197
Encrypted:	false
SSDEEP:	192:BiE0M/OIAARAgeLEwvJzk0qAN6FkFi7ZFiNcL1eDpf:BiE1/6FLEwhzNN6FQi7+Ns1opf
MD5:	5DA0C31689359B47E3E1029A6F902B6A
SHA1:	71F5FC3E2D97DEA0006B1145D955D3EC96A3C1C3
SHA-256:	2B3D5ED45886C6A1A2A6C22289B6C8EA42F46070014276D48CFF86CF2F20F458
SHA-512:	3D827240FD7327739A780FFA1AA31FAB8AC96969BCBDF092FC31808B13D04A9525585DD5231A6AF2D7722F0828B3D7F292E84BCFA2B00AD2D101E97F90918356
Malicious:	false
Preview:	....Q...T".&.....r.do..F..OC.l9...Y`.F/....*Sg..\.\S........rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{0830e2c6-fdf1-47fe-a23b-SS....Z...1.m..U../.57..P...@.4\|[...?.H+...\|.5..j.6r..........s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/t7..6.....e..9.....f./;.....@D.4;P.$-_.x...!.H..J.hD......../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll F........X>.&....s.\|)..d.....k}....4..p...#.&.B.Y@.........gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200.J..A....X7.m..j....?...P.@.`.5n...J-G=w....c0..d.sS.....U..rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvVCU...&...u=.5........5..T.JWF..,1......

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28230
Entropy (8bit):	6.706823021209847
Encrypted:	false
SSDEEP:	384:QMnWUAo9RLXCHSveE/2N9XB6o9NGRAeFPLe5L9UPckSAqjtO5vqU6i1O3U2rdjcT:bfSHseV1LGrKB8boDn3NxRninV3
MD5:	29433E6E7E4DF8FBFCA8B15C66F4A5A9
SHA1:	1BAE324327BDC96C19579B9B82239757E12EF087
SHA-256:	06054FEB124D64AD3B6C8441ADB003C93A6215ED260BF68BB38A50C48775612E
SHA-512:	71A80E2CCAEEE2800C5FD53003D4629EEB8BFEF4E6194306D861137D46EDDDCF1733D021E766E1BCAB367AD13DC67DC02CD714F6B0D6CB5DDACF0773BCC44593
Malicious:	false
Preview:	1..-..o...h.........t....h.!.wNr....;...xY..\....p_..r..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c959a300-16e7-a661-1f76-4f2da7a96707}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.<.b..zZ..t........fWK..<.u..xiC....).j..l]..A......jX....p...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office951C0FE6-40A8-4400-8003-EEC06.f.W.6G...:...A..n....i.s.2Ig...w....dy.......z.....6..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X...#..OH...$....[...t......m..!K<....s.T..f_..T....\Z~....J;./TM/v2" value="Office16O365HomePremR_SubTrial1"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http...f.,...u....Q.....+^..A.}....p....w....}_..F....O1_....n..ity><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4B.g.S.4J../..[......eZ^..6. ..6BO...w

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	11954
Entropy (8bit):	7.076910244395746
Encrypted:	false
SSDEEP:	192:PUG2nhkpYXkcOCn5sCTjbASxHUgQJvLXTZT5ctsWeqqM:8GMhkpLC5NToSKgcT5ZHdM
MD5:	2D866D485897E7EAD1BFFB77B3B6378A
SHA1:	B4C2CD955B7456CC03CDA3BCA1EE270E563A3EAB
SHA-256:	84389A30C2E85886E1EF973D66A9B06B5FEEB0EF236636892E7322D9A620E1A4
SHA-512:	87AED23C94D9C59C2D628E943F4921A08B46F597475E827AB59AC80231BDF594E5FB90594FCBC3CD6FBE9F952194435FB222CAA2ECBBBF7ADE6EC7A85947D44B
Malicious:	false
Preview:	...CRR>).%..!p.........=h...!V......w.7.".{...i.~.....u$E=.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{182e172e-6a38-4f82-a979-K..F.N1}.0...j?...s...H. b...y.......s.u.+."JP._$......80F".s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/n.}P5X...\|...>-...:.....L.j...yT......&Le.q.w...:@i.....$gYt.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365HomePremR_SubTrial1"w...WK=..?..:z...n...P.=~..."H....\|.%.3.j.s...8.I....jr[<.pertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.oX..M].cj.j...${.."...+97u...i.....H.<]{.Y.$.%.y?v.....y.Rx.4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUX.j,"cgq.x..x...M....'0.4..9L........

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11499
Entropy (8bit):	7.136708226381626
Encrypted:	false
SSDEEP:	192:Mad4BsQGuSAbZMBJGq0aUlD30pn9A1S+tvS0x+9pGMkF2:MaiBqlAkJCD3y9A1Sqv30pXy2
MD5:	65AFDAE6C2BC22F6FC2B41C7877CC615
SHA1:	0E4A41773933F164CA73C79629BB07D87648911E
SHA-256:	03BD18910CA63665DCCAE0153A0888D291A7D7DC895A7DE0434641551D47289B
SHA-512:	9F12B4419B8D1C64A3105F27BCFBC49C5605F49A69C460474E9FBAD86B8BA44305ABC00998F86AFE4084C45957962BB6189DD31BACCE87AA5ECC450313AB3B1F
Malicious:	false
Preview:	...'%...>.h....K.H...S..e...u......O.Q.Nn..U.A......=C...`.G.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{5231bd4b-af7b-49f2-a7c4-.rV"/.../X4..G.]........Cs...v...T....A.J`.\...^.....tI..-..X.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/(..4B...,DY.........@....8...r.._..2....!...........*.L...a.../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .'.U{..<.d....B.E.F....G...'........S.. ............_....b.].gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200\iS"5...z.d..G....8.Q.%..s...V......\.........q.\....=K..A..v.rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV.v.hb...oYI....B...C....w..p...>...C.

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28230
Entropy (8bit):	6.696571340515646
Encrypted:	false
SSDEEP:	384:vVyfKU4EfhSWlf6o6fXZv6chnrJnNij3hrmESCZPcP6IP0+EvRyH6x+cGyvKTPLS:vwTi/NhrJNQrJMfLHDnlTT70h
MD5:	4E6A89C2C64084667DDA6D82AF5CB28E
SHA1:	43650A6E1F4610414FD2EACB44FA2821A6CC9DDA
SHA-256:	34B14F4F515BB5558B1C17D9C3BC6E663CEFF60F34F641229344CE39EA9AC839
SHA-512:	EE0FE47144CF29EA87E12AE3DE4109662BFBE622A67BF04079093EEAFD577A7139FB2AA82179D579F9849089FCE9FD197B08817C565B654FB5D3301AA428E44B
Malicious:	false
Preview:	%..g,lkVX...I.......{.....5..x.pa$O.M?Ed....4..6qo.V..#..M.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f72c42e8-9b60-7062-52b7-823f7e9b316e}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.t.()y~.Z...V.E.G.M.iH....oU.t.WP.O.._O4....?.. =.R..i..@..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeFB3540BC-A824-4C79-83DA-6F6BD.Y.mPWD.(...E.L.O...a.....bS...wt,...mCw...o].?kp.S..b.....15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.U.i<@K.......B.V.E.a.{.....aM.1.u/mM.../.....>..}2x....T..../TM/v2" value="Office16O365HomePremR_SubTrial2"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http.7.,dc(W......@...E....4...]...*cp@..mCf...8..mc'....u...ity><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4B./..RW0.I.............jE..,..,.\|\,...

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11954
Entropy (8bit):	7.077786765909986
Encrypted:	false
SSDEEP:	192:ZGHzp9O9gbstWqrMJBSomdDGeF5mMwlQ2Xh0KL0IqlRYafS4cG:ZGLOGst9U6AoRsDOKobpa4cG
MD5:	DAF34680180AF8BDAD2423C4D2B2830F
SHA1:	9F368CA35E34BAA8997C0F2C9FA02549C95F5E9A
SHA-256:	12711C11EA901C3CEFBF57CB1A1F1CCD13C05D0D7182F227D0A610DFC421FC45
SHA-512:	349CEDFF94672B62B5E5781C0EAC64FA1640CDB8CC4F40F11EF278F1B0DEA7869565B1616A5D3095F933749C9F2C2843AAFC2E5B207305E2A737892CC5293859
Malicious:	false
Preview:	.Q..(.Ee..gQ...!0....8...a.p.F.I..^...q...jwM9G..0.....t.:.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{2492ceb3-b108-4298-9161-.$.v..oO.4....7`V.i....\|..s............S.<..q{.....aV.`.%.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/V.Q.O.eE..Vn..m3....s....A.w.......././.e{@/L..7..Q].7.s.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365HomePremR_SubTrial2"O.3.-.FQ@.G[...<~S.&....a..r.E.N.......m...H.C9....2....H.".;.pertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.o`.3.'..&..-[...<d]...&....k.............>...o(Y.A...(.\|E.Q...4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExU`.F.X..=..@Q....@Y..)....]..].+.f...0..

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11499
Entropy (8bit):	7.084923161848276
Encrypted:	false
SSDEEP:	192:/6mguhJScumFhnnIqpjy48RB+HZsNJlcZ5uAJ/:3gu7SBShni48RBeZslceAV
MD5:	D8FD8FC44C0E362F31CC49B0B389A321
SHA1:	FC5D193B6D3979B15922EEF51AC1454AB9BDEA93
SHA-256:	89258BFC109D05CC4641410C2F4B61C60240FAA3D7DE108348DC6CAE539A9345
SHA-512:	37387C6C2A0D6AC08A478A2AA781FE4FDC8BB8C386D7770AB8D7FA64957C4BB6DA8DE9151A28173247E950021E0EFC8E021FEBBB7E02DF3FB2DE4775216C9D92
Malicious:	false
Preview:	)...Z.1..6}>..5.8d..>.yE0l.#.&.ki...S....9....D;t......3C.....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c081ed9d-10ae-476c-a244-.]F.U.=..p*...#.v;..oC!.&q.p.1..&......{.....sH..c..@......s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.n<.=....oL....y.&'.uOpNmL.,.".i-......#.[..k7y..=....fY...@./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .]....9.."q"..<.$i..&]sY.o.t.3./s........X...s......UW.....gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200..A.J.1.X3q+..g.I...em}G&f.v...<p.......x.F...qO..&...bH..+.rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV........Mr\!...<.1...%A[L"J.;...~L..%.

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28230
Entropy (8bit):	6.677660485919297
Encrypted:	false
SSDEEP:	384:Wy1If4UG4xFglWY2fYtssHvNir3dB1x/uOPc54ci1JdhfY23E7gjKFT8ncY3K2c9:W/3FiPKsBlUdB1x/7gP7uKOcYNbe
MD5:	D3FF42A82A957613DD618FE9DE1AB5AF
SHA1:	85A199F1F2CD4B8E8AF6B1B423E302A782F4761B
SHA-256:	EE86AB84DE1447D2620B5B25EAA96C87FCED5498E787D0099F1F15A20C06D8B8
SHA-512:	96F1240F908B0CF93BF88F4C09E5C6C45D2EFD4C64718C7B04FE46FEF3E527529F59AF37D902B1FF4242519878F4AC3B45F9D9C6162EB513DDDB0D129F79075A
Malicious:	false
Preview:	K..E...[h..'.-aVZ....Px.Kd.L...vg ......a..(X.i..R..b. ....:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8413facd-718d-886f-9ad4-4921183d41fa}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x....@...Yk..n.2j.B...O...)Q.>.....GM .}..z.{..#E[......e.h.....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office86AF9220-9D6F-4575-BEF0-619A9.IP.J.].+N0...!j....Z.Wo.J3.Y...coy...]..+..s..`..J../.b.[...15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.2].U.%..,V.h.&f.....L.Sw.\0.C...8.".R..D.8.."P.".R..C.}.O./TM/v2" value="Office16O365HomePremR_SubTrial3"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http.P>...F..}..'.${E....l...C.bA....t3/...]..)..$B.2....b.h.O..ity><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4B.H<.;.^.J(A.`.t?SJ......h..}.G...Koy...

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11954
Entropy (8bit):	7.080723504342308
Encrypted:	false
SSDEEP:	192:0QL9St2Te5iUkSO+GytOGdItA5pfqsM92jEHnuKy0FZfoJvN:hLAt2Teg/Zy8RALfdQ24HH5FZYF
MD5:	DDFF3F5793EB3F437BAF12E083ABF0E8
SHA1:	44B6B0C289F7EF629A2915D366BC3888E561605B
SHA-256:	64D44F52D3630F278E7CD651120CECFD1B2C0C4C841C1A5D795AA32342117F10
SHA-512:	074F3C52AC02B12EA6DD0E02E9D3DF708230410331DAB77CD7CFB0B637C7F5596B7ECFADFF97C3628447F4771DF676111ACB247F726D67191BD66D1682734EF6
Malicious:	false
Preview:	z...b.)TP....j...z...}a....-.[..oS.A.e..J4.......+.{.(..1.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4c58b0e7-4bd0-43ae-b30d-.....\|.#@G..S%..M%N...%-....:....y..Q.a$K.Cb....-.....Enr..2..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.-h..h?.F....7@..9.U..tj.....).Y..)+.C.4t[..;...H..&.b^y..-..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365HomePremR_SubTrial3".C.Y.{...J...`..H$S...j5....&.E..o..".76.......J..-.).l./..pertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.o.....BjD.....a..Fh....KN.....&....D.....eE.11........*.ysa..&..4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExU.(.x.SFqM... b-.B.pr..]B..........sQ.Z.

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11499
Entropy (8bit):	7.0964649266622875
Encrypted:	false
SSDEEP:	192:jOhaXoU3r1zeaGKI5X5hQEV75u3PQ4v+sgQlp:j7oenGnhQE95GPbv+pQj
MD5:	F84CA1D9700106B0D8A77A0DA5DDE8EF
SHA1:	D87F9667C2E625391976129720573F6439730A17
SHA-256:	E0203AE265879B0518479593F7B28A0A9DF83091D2181D8FDBB5BFD1D40703AF
SHA-512:	E015CE828B296320CCC9E94BD42230EC8D41BCFBD1DDF1AC050528F541EE2C1DAFA4767DB861C4CDDFB9B51EC5359AA0E8ED9EA19136F6C5E9BCA88862020FE1
Malicious:	false
Preview:	...B..$..u[.kx.,`.Mje8...D}...Gb....... .D......9..f..o...C..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{a6330390-8f47-4be3-b6f3-.......5\]e3^:0...G;=`B..N...G.-.......b.MQ._.-...7Q.....@..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..hQ.....,j)7gL`c...!11...Fr..GE&....@..:...."...2..)..:.N@./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ..W0..,..aW.\|x.%.....r#2...LF...x.............L...9..z....Y..gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200..G..$.pW.;3@~.....1.<....(7.F.{...X..a..#.Z.*.(..n..>....+.rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV..U.....1z.^kO%e....q?.....e..cRG......

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28230
Entropy (8bit):	6.739995353821149
Encrypted:	false
SSDEEP:	384:Xl7aDUUQ5DsEmaJ4HzMAf70/Q9Xf1Ne7V6HUPcsPoDsr6wVzR6qRDXaj8+/Py7Kx:B7w1amTi/Q5fTMmkP0wVsvj1n6k
MD5:	F89739BED12234FCB1D2CD8DA12E71B5
SHA1:	C4F60D56693F9BD4720FA2EB6746732153A2B789
SHA-256:	7D90D9AF1C813FBEAB06719811C31FF3DDDEC5057404B32C73E1471091DE4A55
SHA-512:	B5CC660F010015AB6052434A34AE09E4146AEF53FF9CEDA3336AF4085EEFF54FF3FD8FD314F882F425ECEBFF336A82CFF7CF0F2D7CCBD794FDFEE16F7098EFA6
Malicious:	false
Preview:	.(...hP..ZGrS`...P..7Fc{.......5.FK.U_\|h..A...=.0.6...^n.N.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d6336c7b-2045-b5d2-a946-fe6c4a24f207}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.....}E..F.vLk....J%.7...D.....lKo/M....U...t.\|.y...U.\|..K..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeAE9D158F-9450-4A0C-8C80-DD973.....'~....xr_k..B._-Wdl...B..2.N..K..n.B]....=.....P^.5.._.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X...Dp.....~Xg....I7[`t...\...0Q.IU..l9.Q_...:.s.6..<h....p./TM/v2" value="Office16O365HomePremR_SubTrial4"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http....g.....GGtZz.....iEn"@..L...o..D.K..n.@D...7.".k...I.#..S.ity><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4B.....S.......Y.>...<..&."k.....9"N..K.

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11954
Entropy (8bit):	7.026620801264995
Encrypted:	false
SSDEEP:	192:8qshw6lQN3h1O5VEaDzZ+i2qxWUFDBU1scqBYvFU38PdeU3UP:5cw6S3POjE6r2qx9XU1lpm
MD5:	C9AB1793CDAAA9B1BF7FE0C3CB6586E9
SHA1:	D58216C79ED739447876F67EBA2BA381E7D0626B
SHA-256:	80DB26A5E271BD89C68FCDD2F02303E0BB56701880FF91EBF8367108361D49FD
SHA-512:	8E0A66F006D168C71650693A400CBCBBD50964F8909FA9C7E8913660C8A5EAE3C77C38A42F103F47F5E778668CADDC958C605120CC16FDCE49D79D16F36D2DE8
Malicious:	false
Preview:	I.Zi)\|C...#\C.....V....f./4mae%.9.B...9..lp..0.....'.d/...9..e.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4c6d315a-fbf2-4f38-b132-...a'bJ...r.M...].....>.9)g2f2..v.T...7...'..iS..M9Sw%q.t..z@s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.g.zNvc....c..........o.r.onb!..}.....i..>[..<....0.i6.A.h].,Zitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365HomePremR_SubTrial4"...',e@.P..V@...X.....q.*4{Ig..>.B...j..hv..8.......b>I..&H.dApertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.o.R.g&4....iV]...VD...P..>p^j...r.i...j.. {..o...../.ek.l.5;. T4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExU.b..YM.....\....R%...F...1PH.....^...

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11499
Entropy (8bit):	7.098718644143848
Encrypted:	false
SSDEEP:	192:TGnqx+c9q7K+vi2q8q/AgiJ87PVPWCpiNrWZdDH:TGnM5oe2ihjps87PV+CpiNKZdDH
MD5:	AE3C23E2D8CC0D411669C1E696063158
SHA1:	5D240B907ACA1F1AC4187DAB6203113569B37BEE
SHA-256:	872FE312C48832715342793CBE908A4CFC2EE38D82163A9253B937D0C2E2501A
SHA-512:	5406281ADB8A95FEDD1799E48B7B0DE51BA271AC2CE624315F092727FD20333E1DF75D92A552EEE358A3F332D273838E29B80A33323E6A1E21831680843E7C12
Malicious:	false
Preview:	.dG.ul....<.?!...(. 6....U.h.....F#.H(p..........Fh.3(.}"B.....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{a0f40d9a-c07c-411a-a533-....\|"...j.1j...f.}<.K.TC.b....I.:..w`.......[..pA....CQ......s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.....f.0..-c>...6.4r.G....j......a.5e0......&..Pc.$g.]wX...../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ....+y.A..0.(!...4.!t.U..w.`.A..H\%..\|r.......H..Xh. 4.iDV...gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200....el....0.oj...Y.Ec.e..C.2.0..[_".[e(........^..~y.3 .IsI....rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV..2c.......2...!.Dq.I..G.8.....cx..^b.

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28230
Entropy (8bit):	6.731165638150457
Encrypted:	false
SSDEEP:	384:Yln5hlUpcY6c9XZzfHxyPNznOSL+NOp5BcFAVPcjWpg55zkwQusfzbce6HtfKyQY:KPcBqP1beu0FosQvzbFYPKw
MD5:	96CFE70C26198C32C56C7E263AEEC305
SHA1:	03BE390201CA4B55A9B5011802DB8F6B62C6EC7F
SHA-256:	38FD4CF497C66E99FF826C0BCBE8896E163DEE965429827D834A00E2BEB661D9
SHA-512:	75D3E53B2BA666DCCDFDE1473C8960B9F22737E4EC12D6604921ED30DF50E48DB30B042214A8AACA66A4C9F6EA5535A17C0DBEFB6D514F61EA7A7D6139F8504B
Malicious:	false
Preview:	.v.]...;[..b4.g.)....rB' ../..T2.).kP..........v....N.`..i.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e4405e2b-a387-c54c-f247-89ec972d7100}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xB.X....jY..~}.x..1H..A`.sq...x..s..)..B...........3......r..l..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office95820F84-6E8C-4D22-B2CE-54953j..P...w+.30..k..x@..ThS 7...:.US'.p.u...........i......;.x.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X].zS.8.x..U.{.l..bJ..Br_$/... .FQ\|.+.>...........a....9....W./TM/v2" value="Office16O365HomePremR_SubTrial5"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http.......:....4.n.hJ..b.jf....g.~.0.&.u............>.....-..t.ity><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4Bk..#./.zJ.B%s.>..9....c.f0....$.QX..p.u.

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11954
Entropy (8bit):	7.0492731889120686
Encrypted:	false
SSDEEP:	192:aWqwsOMeK0mvOnxvYu4nYP7CL99gLbSiUYoxmP2br5U:7qEMeHmGpR4uY94b5B+f5U
MD5:	B5E8C6FB98BA58C72C8AA8C486F75ED5
SHA1:	1A48B3522FE17DD234381801544DFBC4B7B08BF3
SHA-256:	4432C810DA23CECC627766A91FCEFDDF2FE6EF93C1A5D31F0C4682A985C46802
SHA-512:	572A08EAB23AE110523DBC76543E3D1A8CB9C3444B8D4A108DC1F92F2BF03C52F9DC8C69D76B03F0B517DE7083CA1F87B3309F62856C12A370F1B39B3D5BEEF8
Malicious:	false
Preview:	....?..p......qk..v...b.....;Xy.\|y{..q.jo.....J.p.....%R.>*rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{43643884-d175-43da-ae0f-/=?...)j.a..O...6.S........~.`.4&k....=fA..O.\|..Q.....hF.!~s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/R.J...-w.OA.]..2.KI"..B...9.;@..y./.A<........w...O.t..wditle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365HomePremR_SubTrial5"Kb(..r4.z...../+..y...b.....%_7.>3..m.l'5......r.....:..?.pertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.od9(...../a.z.....cg......h.....\|.1->%,.>.a....:.Z..h...b.)w.{j4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUd.].....&s.p\......l.....^....~w>.~.`.

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11515
Entropy (8bit):	7.131905443934925
Encrypted:	false
SSDEEP:	192:zX7zKvaTNTchi41QoF7REANyyaXg2R7o27BUd2F23vBX:r7z2y611REe2doaUd2M3vN
MD5:	CCB887AFD04CA3F2132011E8673F6438
SHA1:	8B652A8497AE1DC3B41D5A5ED5813DAF8744914F
SHA-256:	ACDD3B9467579087E00EFFB0FBC0FEA78AB4D09368678CC6DE833D03074E8CB0
SHA-512:	7E9DC54AFB7305F80FB562C5AB9C841B5DEB657AF268037A81851195F5DE977907CF9CFEFA0E13C12109EB79BE4A796ECE7C14C738E30773FC91AC5CFB20B842
Malicious:	false
Preview:	@ .9G......p)..A-....m\|F.4#.L.......+......M..........`"trg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b2010d93-cca3-4c4e-a645-..a.1.P...UC~b...c\...r50P.>p.[.K......%.F......=..h.W.c= s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/....^M...2:,6..B3@..~dw..6,.H..@.....d.....A...E..N...mxr/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ..'.gR......g)..^1....lg`d.<tHY........e......\......}...z8 gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200..e.)G...... b...\s..\i~P.nv9D.......M.!............J.;.:.?rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV.%.~H"..".E:.D$e...pOuT.d;.r..!.....

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	31710
Entropy (8bit):	6.696567793208057
Encrypted:	false
SSDEEP:	384:Pa377U/DXvIgWPoTcq4rTpGbpgICN+TZq3ePHC0aXeBt2UW34vn8vYP0BMMKGK+U:mCgPl4CISpRO4U848K3r
MD5:	23CC4A0DDF5315ECC0C11B0600C9107D
SHA1:	ED833EB9131C7962DCCB06962C8FD13AE06D59B1
SHA-256:	C4D99DA47998147CE6CB98132757E0A414D99113CC3C4C7DEA4F7FD793447639
SHA-512:	E79FA6A9612C64170C8750056DE9CCC7A78C3B6611CACED359E913FAFD60330484D6633E63C9C5750C4CE9A067210DA65F6C31D59B2FA7A35847651D2996E79A
Malicious:	false
Preview:	.e.C.M.mm...X'.eo..U.RH....gO..,c.N.i.I...Fm+.......F..E.3F+F:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{aad6242e-0eb0-b4c1-59a6-e2997cf635ae}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.. ..X.<o....#.n5.]...Z..GM.=.S.#D.d...[..\y/........\...>D._.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office537EA5B5-7D50-4876-BD38-A53A7N..<...!..(Wg'.n<.UG..R....0...id.F.o......q...B...L....w.:M15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X...M.a..;.NI.+.b&._...H....3...zf...&......s-.........l....c~../TM/v2" value="Office16O365HomePremR_Subscription1"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="..:....v:.B.B-.d!.V......1/.!y..B$.{.~.D..mx.............b_cXriority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-884L.z=...C..ZZ.x.>f..K.B[..KL.!R..~y.A.(..

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11970
Entropy (8bit):	7.087340798921495
Encrypted:	false
SSDEEP:	192:g/MsOLTQtWo0EuuSmv2UXBzDUvofNSD+R5IQxtU+npbESj6XsoV+:4vOLMWodumvNXZ8l4HTPtES+cb
MD5:	DF2C075382ACD8FFBEAA432A5E1C063D
SHA1:	B8A89B9D16D7D17C72FEB65250E2DFCE5248A47E
SHA-256:	352E7588AA1D8DDEDA90CBBB20F3437E6F128651887C096A753EE02B80CC9C40
SHA-512:	EB8D1FAA98755FDE29D4BA08D4319FCA4065C4805181A105FCC048D05AFC030B2A9B7CC610D782B12024F0DD2C52CBFA6307B492A5C96EDC1A774641A84FEA65
Malicious:	false
Preview:	_._......i..O~.[_...v....,.n}.IZ..C.....e..o...:...#6.b.Q...+rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{68313316-9fbc-4d73-80c1-....U....}.PA5.M..K.\|@.VO:.d..^...Z...>.a..8.........n........s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.j..n....0.-.a..\.W.2Z...q.lr.M...G..,D4..D.....i..../.!....Keitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365HomePremR_Subscripti.V.k...~.8Q{.M..@.5Z..Ss.x..A...[Y..6M4..d....(..n".2.X..Mc:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.....D..../.O...M..A./T.ISs.YU.K...[...0f4..d........./..(....@pIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQR.}..D...lV.T.<.GP.B..P.&>\|.OY.}_..u7..?Q

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11515
Entropy (8bit):	7.095738654190478
Encrypted:	false
SSDEEP:	192:pNbiMTD7eaPRxTjScV31y5zDz8QFAfMWjUsLA:pNtDq81/V1KzDz8Tf1jrLA
MD5:	FC6348AA2F6062133539D752A4481694
SHA1:	7BEC569CF38D464367B917FF9CE6A3C8CA012D90
SHA-256:	DAB5A6075A75DD8C41EF5B90DF88F3C5CA7FFA8EFDB98E80CFD5F9EADF258612
SHA-512:	ED65674B0F840C046C21565E8F7015A3D88008E714573EE4AE634B630C1D9C5480A8DE8B65625EC92A78BE1B7E42E3CFDAC9034532454B097F3D1FA97AFE7F52
Malicious:	false
Preview:	LY..?....~..../.\k..'..[.B..G{9.....]........e...YR.$%.....erg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4b54a811-0801-42db-92f8-..uSe.........[9\.4.v...._..DlaN....M..BP.K.Y-.)..xe..VH...1s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.Z.X....O...Ic.B(..l..PDb..@.a........\.....$i...N...p.....c/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .e.a.....r....&.@f..?..G;A...n>O...._..]<....Jt...JN.0C.....1gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200..'./.....r..E}c-...\|..Y.H.ds`\.......uA7.9.\/.'.YZ..t......rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV..gBx....._...J&.U...<..R.d..BEE.....O.

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	31710
Entropy (8bit):	6.763900181993375
Encrypted:	false
SSDEEP:	384:+AzdNU/xXbOzgk6Wrl44xzj099zg4CNlkv6zQ+ePdsGaTJQFYswafEiEgUmZZ+pR:X0ROr7u904Sl1B1AL/jHnETf0HLYNH
MD5:	568E55AFA3747A6A79295EE6FD34C1B8
SHA1:	044169A5843B01889A0D9D2EB644A64859EF849A
SHA-256:	58499C4D846C459B6F20AEF646BCFA0403A616F4C9DED34548298747CE32AA97
SHA-512:	453567733F11908F1ED9BABFD0BB699FC896FB1AC1A621DDABF9EF7C6F02D79395381ABBBA24F63B9CCBA3B1327B7EC83CADED6A78D743AA7A21205F117486A6
Malicious:	false
Preview:	.j.....3.^......s..3..&......z5..3.M..%?....D..l. ....\.S.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{00cd3153-3e5b-0244-7a1d-2abb59f34c52}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..S....I1.I......./.*v.rI...L...]...F..=.?+.......).$..JN.Q..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office52287AA3-9945-44D1-9046-7A337J......TC..V.....'.`c..!....J...} ..5.....o#....D..s.%...@....15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..q...[e..H......-..u..%...T....{.\|..]..\|!....C..{.c<._9.k../TM/v2" value="Office16O365HomePremR_Subscription2"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="..I.....d.........$.ar..g?......=n..$..Q..l?....X..`.rJ..LN.J..riority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-884L...i..6R..[...E..t.w#..jE......`-..r..

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11970
Entropy (8bit):	7.087128376470324
Encrypted:	false
SSDEEP:	192:sjSRFOcJXX5YilDScCVRFOfLZOFDfBgqqg/1R2ULCT7V4:sWEWnq0OjED+DB/qg/1YH+
MD5:	D2F90BBFB011EDB64A3B611B07292766
SHA1:	B5C4CAAE05A6EC0273ECF0648FCF157FAB2681B3
SHA-256:	B8D803457A4A310AB56B5E5B5846FBFCEDBFEFCCE76EEA8927DDB54D50EE79F6
SHA-512:	8DBD65D0E335FDEA055572125F04EDD9FA5AACCC785FD94F587AAC5DDD278C9B3DA0CC93DFAD71C999EB7078A6B20D6412E55B8F019A8707DD29B10E7DBB0FC1
Malicious:	false
Preview:	......q=.....O....7.rz..)"..-`..........>....q.E..hL.c...Z.S.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{11558452-63d7-4af4-a344-:.b@].yc.........h.x+...??.J.w.....\...\|...#.yI1.m.;....L.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/F)..c.Q.....P....t.61..t...d......w...l...\|.N,U.K.z.......itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365HomePremR_Subscriptim.`.f.3#.....J....c.11...vb.J%h....I.......s.em.J..w...S....:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.uH\|LI.3c.........b.+?...v..1.b...........9..~.B:.wV.A.......Iy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRn>vI.F.n.......a..;..y.8=.T.....a.

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11515
Entropy (8bit):	7.098360244341495
Encrypted:	false
SSDEEP:	192:i4C3tONoVXlAFI3XJTQ+CEiDSOoZfMv998OoeW:i4ugHFYJRCtDCtG998QW
MD5:	FA3B28224ABA759118C3B6583447F506
SHA1:	5DCCFF86B0EB38B22977B8A464BCAE8B872B57B5
SHA-256:	BF29E8CC7361D7F73B9A82168BAA743B00739C3DD29291FC6EBC4A9198CE7BBF
SHA-512:	ECC694660BD3BAA1B5309BC734465D7D664F1F66B6798A52D9143BA5846C5F1FE214E9D2C048CF2DF978129D01AB3596816AE8E63E238D0E231C71766503184B
Malicious:	false
Preview:	;..\|..m....t4....T...S...k...8w._.m5..6{..nUV.....9......o.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{12784a1e-8f51-4c13-ac49-.y"q..9......?{...^U.....8\|..}8.IY2%..89..8......#V......p.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...o.M....ki......O..XS..dx..:3..l u..ya..e.y......[S......5./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .,2..e....t5........O,..<-..\|m.xP97.xG..g.......*........u.gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200.bpy..m....?e....._..Q...>\..on.J. m.P:..Je....9......^.rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV.}03.E.....gj.........Z...sz..-R.@].'.

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	31710
Entropy (8bit):	6.7022564978301125
Encrypted:	false
SSDEEP:	384:NSsBCb8kS5UNXHfwrgRknkeiq04LcQvwS2HjdlTCNKjgzjOm3fePjX18Nvo1viwc:NgmG8bAHpVSPXOJXmavi47UcpA5
MD5:	B08B530639210861C27286F061FA0FD9
SHA1:	BAF9993E6C92ECC19008EFED0CC817A13232E9A0
SHA-256:	60D80C0B787D8079FE1C5B0EE6570B4CFA7051F3B3D349CC511D023C2CACE2BA
SHA-512:	8B0A186C913A55D2C437C82B8E4B4BB319B3A1A9ABF11028302C237175420605FF9CBF0FF07618D84255B4496586999C0037B7A4DC1E09203160ECEFFE8B236C
Malicious:	false
Preview:	..g.{...8...5..d..`..l.Q......Y.5..3.....7.8T.....b.t...N&3:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{1e701ab8-aa5b-582d-47e5-18c0a65d4565}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x`h0(.n..../.....\|..5.8........h..@..CAC...8.%...V..x.>...L#.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeC85FE025-B033-4F41-936B-B1215?5...@..i....9..5...}.F......L..3..a(...0.jT.....hR5...7815-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.I.i.W..O.....>./....q.^...........z..#....'.0SW...H>...v.o/TM/v2" value="Office16O365HomePremR_Subscription3"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="ep*+.,..N.s...(.)..~..d.v.........."./,].$.?H.....>\~...Wn-riority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8848)j..4..x.k..^o.....h..K.......A..t..

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11970
Entropy (8bit):	7.109611240466
Encrypted:	false
SSDEEP:	192:zUrwZPrRbC87C/SBAj3+/zGcU+hwHLwUhMywSah5gK:wr+9sS8SzGcphCwGqT
MD5:	1CD410B7597EFCDB0BC38A1295F0C905
SHA1:	410F3E6A6915FB88EFE2B0AC3C5247856DFB490A
SHA-256:	A851E1DFB297C8A668520663FC87E3D78EE77D0FDA07694D0270BB11454506F4
SHA-512:	B6085C636A8AD001E59EEE6FE24B87D0B58A659CEF6B2103B5A1E6ECC5B02B67478FD5386EF16E13F7EA9B075E772B359697F8A65DACBDC48E47F3E3F6B4370E
Malicious:	false
Preview:	.9..[.M-..UJ$..l....%.....-m.1.y..xe.k.......Do$....RN.j.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{68d380db-a4df-4b4b-a780-[.S......j..[.k.."....}.......z.t.`...va.).....].rFN.......u.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/).{..{._t...Uy.r...q..R..*i.3.;...(4N9........"3........#.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365HomePremR_Subscripti........W:..KO...<...j..P...%e.R.a...!4^X.....Vg......CG..%.:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www........]k....d.."...&..P...o.E.a.....4Hl.....1..};....D..(.Iy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQR..N..l.".............G.._...Y.K.O....=

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11515
Entropy (8bit):	7.113485425864611
Encrypted:	false
SSDEEP:	192:2TpG/rOqDO5kZf/6JNOK0fSCdrgZbCklS:2A/iqQkZ8NL0fSmrgZbCkg
MD5:	B7BE9747187E24B41BC06B89C52CA09F
SHA1:	C6190CDB03FB2846DA0DD2DEB0D0D49AB3296748
SHA-256:	3C8924C25B51DBD8A7A5E862806F8883E69D24B071455FCFB3E3E0FBA3A9323A
SHA-512:	0846C68F97959A688DAB479446F85A683691EDDE1F41D5540618D6FC6CECCF18887685214543B50EC332F8E225768F366EBCD9CCDF2A075846DD4303B821FF66
Malicious:	false
Preview:	U.]e;.....1....gH....8.$Z.c.2+.....<..c.....V..!O....k...v..\|}.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{7d253fb2-6a39-4f04-b9a7-..k3Q...1]...q....i.\|..~.a(..Y..@.s...L._..is. .+\L..,...bJs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..v\....."...+K...s.-Q.C.=,....Wzu.#.B......-B....$I..l..q'./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ...e.....=..nW... ..F.`.ey..X...I.a.C2....0H....w...b..fgJgPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200...`+....=....5'....c. X.i.g...K..)..;.kO.....kt....c...}..&LUrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV..\|........nM....#..S.E.*.....N#D.q.

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	31710
Entropy (8bit):	6.782817528969305
Encrypted:	false
SSDEEP:	384:GsMausU4XXgr5tzas1T4a4jjWKZvTmCNGb7vEeP8NEX2E2P9x0LqfNg1lkhPsKz3:k/AAKdKSuvkPTgqeK44
MD5:	087E6AC84D14CD543B72EB0C97C9658A
SHA1:	1F2075228C199B62D311ACA3C14C5E6D09A778F8
SHA-256:	D9DFA31C26AECF97DFC80488260D5911B67FE81C2CD8854C91B0B19C0DCFA8DA
SHA-512:	253F7B5952DBDDBFCCD6893785A588D8C92CC81207E7004E75F35E4278A6B9EC8CE825DB132CF4C8D9330902865D48B91EFD2895F68337DC1FB0863DF9FD8C60
Malicious:	false
Preview:	1..3.w...8.i......M................U.\|F..)...C....Lv.R....:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b5406156-6f8f-c141-f3e9-06e08214878c}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x./.\|/.b...q.v...M.X..W....]K........G.....-......O^Hl......microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeB58A5943-16EA-420F-A611-7B230..>8#.Y.w....e...E.........PM.........zU....EQC....I\|......15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..6=:.W.Q...w.b..O.t.......SS.D.......-]../...D_....\.%..../TM/v2" value="Office16O365HomePremR_Subscription4"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl=".7../.5.P...".t..F.........A).}......X.~...z..._......X...riority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-884.nNMQ.7.f...zX3.....].$....A.........

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11970
Entropy (8bit):	7.1200091735544895
Encrypted:	false
SSDEEP:	192:I6eHImd3vwvO0q/IN6z5d64tUK7UUmtG8TY0OUtK:JOIu3ovtq/I4FYi7qlLOU8
MD5:	C1F539DA5BE974D0AD1264A8A1EE2F36
SHA1:	3F24505B06431D94A806C8F60B3731EE57B2EF29
SHA-256:	6E204D072A62F3164FDF826546F07A38D1A1EA6ED89740B6F5A444BED2B2D7B4
SHA-512:	EB072CF639DCBF338CE5AF053056CE50C95E871C0836FB8695EEF597435D33C5053C69B0568A632C8B050A670FD084192DE9F0013B95028FBCB4963D0AC14016
Malicious:	false
Preview:	......H..(.PS...#.Z..v....N.c%'E........."..)....F&)u]O....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{89c84efa-fba7-4978-8963-d........=..]...s..W.'.....D.`2..W........u..@{....g.qK......s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..r...h..q.o..A ...[=..../L.d!.G\...........$...A+0l......itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365HomePremR_Subscripti;........?.zM...n..W\=...OX.k-h&.........)...+.....k=u.^....:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.#..A.....n......s..WF3...2y.F'c1..........)..N&....\*.J.Y...Iy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQR8.G{............,..kb7....&o.O."?......

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11515
Entropy (8bit):	7.127434255589386
Encrypted:	false
SSDEEP:	192:p8pE3LWLu8dCRDjYHq9L5IMXN91lh5u3+wvTVYIcr:plLWLPu/5I8N9nvuuwvWIe
MD5:	BDF1705D75B865B01438268472EBA8BB
SHA1:	C6E18D3529A21F7937EB4B5FF7EEA7F5645BA99D
SHA-256:	B47FB267B58E70F16F1D2C4CA14A08D9F86A02F6C21A0AE2F5071E895935ABA6
SHA-512:	C30AB6D3DC4A9E814F68360C42EADB60F38F297B9E7D0BFA7E2ADD5D16A1066CCB03D8EC7BF065BE59FFC684CC7D39DD4EF69943CC4C83C88C070A7CF268B720
Malicious:	false
Preview:	......H._...]Q..Qsi....m...L...Mm..66...1.V.i....rv..`.....H..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{bc28e768-022c-47fd-8d31-s....@...........,4..C.!.........t.i&...sC_.0..4.[...8.....K.Ns:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.n..h.M....B.Y.O0}..O.f...C...../..{v...+... ....yB..=....E../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll 6]...@.]....]P..M~h.].q........Wk.b4.......=...rs..p....R.NgPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200p.....H.......G. ....m.o.......Tl..{n...p$..Y..3.cY..y.......QrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV3....`......N...X...A.d...T.)..h6.@$.

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	31710
Entropy (8bit):	6.713924482560814
Encrypted:	false
SSDEEP:	384:fHFnOI3c1yUKXT5bg9TjBTDXj1zd4UebnVubCNyDbpkpePuzUs5+qyY3vbidYcnI:dDM1A09LZW5niSy5kr+qL3zOOp
MD5:	6DA729020A02E54142DF5014A752212D
SHA1:	74ECC6E4A1D0237BA71B9A9CE27C30DB0248ABAE
SHA-256:	6F8AD2E20E02582D285956B0DA7F058831147D175F9EB82D183EBDF9E515A361
SHA-512:	A2A19872B1278D30D281A824ED28272C7C398197CFCFD1DC06EF4069D10D00A8A510169B65435E7637F5B4654CC4DFD0101FB76704E098AA3BFDADF3E4D0B489
Malicious:	false
Preview:	...U....&.W=...A.):...y.p.~z.ADj....9.......$e....MzK..~..W.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{df759870-cd68-efa7-bc5d-699fe50e25e3}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.S...U.%.Kt.....udB..-.!O W.He.?.Lk.~....+n....:.I`L..l..R..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office28F64A3F-CF84-46DA-B1E8-2DFA7..t,..Hl........P}(...h.g..-QTC/...?..\....8#>_.`.Hp...%A.F.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.r.[..GJb..r....Jwzn..d...i.ON.<..\.vD.....4o....h..Pj...U.iC/TM/v2" value="Office16O365HomePremR_Subscription5"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl=".K0....K'.H'....L~`..@q.W-W<5T4... ..E.....K7r....s..&..lT...riority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-884..p+...*}......QHa.$...^.-N&<.JC8...xz.

C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11970
Entropy (8bit):	7.0787865794079785
Encrypted:	false
SSDEEP:	192:tFEM8WW4DNSCzTepzfxDmxuyUMgYI4DYnUwWag:tqStECWpLxAuy1ygag
MD5:	355B4FF6B1DA0568842963B53EDF211B
SHA1:	CA3F2735658411C4DC29DD38DB5CA328D274730C
SHA-256:	EA85F02C997D3F1DE2126279C806CD0BB45310C88CFE643C44405CC8ED07644E
SHA-512:	305CFB45B058EEAE1C6E5217B781DAAD8E00F5592CCD0F27B08213C5E613AFC7D33EC8E83BBC25636B771B1DA7B6A8FA8C4764F0720E0E9CA773FC0F9EE6B4FF
Malicious:	false
Preview:	7.XT.w.r........g.)...xp~...G..n...u.E.;...V2.NZ.t.>,. 1T..arg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f55b7291-c49a-4f96-8b0f-.0...:.,.........).t...4fc....Z.w.K.e.A.y....`.rl..U?f..z\|@..5s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.Z.G.}R.....N.y.=...s-^......,.{.w...i...Z?.E...s.'5.q`.../itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365HomePremR_Subscripti.f.J.3Hl......7.t....(/>...\|.v...m.......I0.nH.;E,.18..):propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www..;...hH,........).t....(/C....k.v.K.k...<....=.I..n....6mJ..:Iy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQR.M.=.X=M.........H...E W....Be.X.I.d.

C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	30004
Entropy (8bit):	6.726122245009188
Encrypted:	false
SSDEEP:	384:b0Se3P6aVgg1v5a4AEzk3Jur6CNq3UYna2WGCVhrePEi+MdmYdaERyC8CUGtkt09:bsPr1PE5PSqmtFedaGtPOhta
MD5:	5B1425F0E7E5A7494960B29618C0C95A
SHA1:	25FD546EE95CFB989B21CC3F6467113B46B421D2
SHA-256:	A3B11C835CB7AB3021F21E41AEF2068E1E10DA59437B76FB2E8CAE385B32F8B9
SHA-512:	DD7041C80F26DF0E35DD95B6734096FF4B19BCEE1C5C267CE4692633FC59D078EAC97F0611CE06EB053CBC24DD99B4FE179F64B8283525DB462D0FCEDA721D22
Malicious:	false
Preview:	.....J.h.j...Y....7.....-..cK.D o.-..%.?}D.z..:\|..._..+I.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{5acfc3a7-97b1-0683-9c66-fa18579ff15c}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.&X......k.v@..R..M..r......w.XoD5u.ooW..J^%i@.q.N,0M.....&K..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office35EC6E0E-2DF4-4629-9EE3-D525E.z...[.eN.86..R..E..g.....z..d..Q(6.3I.#.uad.!..3f.......o...15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..z.....C,.&F..^..O..q.....y..*...imUxM.t.fcB.p..q?.....(..{q../TM/v2" value="Office16O365ProPlusDemoR_BypassTrial365"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:.&.....V.1.o..MZ..R..z....k.:.F?B... i.6.73.Wl.N/.........9...sl:priority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4.r....Wdq).Z;;U.....W.....f.YbF.\\|2McS

C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11984
Entropy (8bit):	7.078704359028755
Encrypted:	false
SSDEEP:	192:QN78rKnA1zQq+qqusEPAtpiNnszzgBzQ69PoBZmuh5JZmSsuWYrZf/SBgwL:QN78rKnKlvAfgszzOk6+B4uhPRrlfy
MD5:	8E379DCB7CEF7AC69FB0973CC92FC3D2
SHA1:	E3260537FBE98F2711D41B657090AD1FAF9DD69E
SHA-256:	D1DC801E1ACAC8FB4598F75F0E1FF0F7BC2BE3DC1B92B9EE657B80E8BB1DA9A7
SHA-512:	CAA7EC674527024DD1EE6797397E1B08CD18F7F850446DD114C924817B24918B58FE01A680F16CF3B0B7D0C99CFB0A6EA31834EAC70BB9E315AD696C67FBBA2D
Malicious:	false
Preview:	.6x:.l..c....8S,."~....'..D.......i.3.C`w.<].'...W.N.....h......rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{803aead2-d17b-4693-b02d--..e. ..p..V.s.:Xl!......Y....H.p.{.Sns.~..q^.@k.g.....Q.....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..).f..q.5(M'.`.<=......Td.......+.K.A0&.nvI(...\.......+Z....itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365ProPlusDemoR_BypassT:.j."....N.X0R.Xl....1..D..S...r._..au.t\O9/....J.....uQ....."><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://?..(.'..1.NWRa.m.9`...1........n.x.H..*,.rwO/...J.G..... ......rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0q...T.Q..1.;6-..v.+.......i..:.b.N.F.#.

C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11499
Entropy (8bit):	7.063222072412191
Encrypted:	false
SSDEEP:	192:RHVeaH26JQgTjTPasu734xuJBTrGUWOb95O:jeaWUPTPa/34xCrXPb90
MD5:	37901B98FA1D872D34E5479030E9B660
SHA1:	47716F2628585D480EA9FBECEB190A2EC558AEB8
SHA-256:	F35E29B8398CE467A641A283D3463A0B9D42AD2E1D72C9A4620C2F1F4D6BB335
SHA-512:	B0E5970814DEE140A46024FDEDD3434488A56DCD7846B6D868F43FF94F18E1ED06673AAF2C69F8C29D26CB376E869868FCFF1A607B76261B5A5C129A25759BDA
Malicious:	false
Preview:	jB.:Ka........./.....\|>.IAZ.N....T.p......9.7t....U..\h...<.!...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{468b6a9c-e3c3-4ee9-8f3e-..d1....^O..9....-f..WG....NF.ff.N....{.>"CL. c6.}_...f.5..Is:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..O),k...31D..c.....7j.B.z.A..N..=6.\..X.#.c.S1..C..K'...&.$.../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .pH.t.........&.....dx.UcY..F..GNyW.E..P...`}N_..K..Ot..(.,..IgPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200..2?[a......H.}....'H.KWP..7.OTM~e.\..W.x.~P*I.'m..\`...7.:@.VrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV..ru.n....#.-..&....gd.@S\|.V..j.q$o.g..

C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	30139
Entropy (8bit):	6.75250186792362
Encrypted:	false
SSDEEP:	384:+x8TlMsQ0aLgtcHihnVO33t6kkkONKjIxsxlNhPcp0u0z8VdR9hfqK/uKkdDQfuV:vKOcHWUF9uLxTEuZhJwDj544489Xnp
MD5:	5F5F105F23DD2B8220CB44057419364C
SHA1:	B4C77F6694B782E5A5748276298C47526BD75717
SHA-256:	A1EF9E4E009C6734B8FB7EFDF33992E79925AAD424BC0FCFB484315EB5B0BD9C
SHA-512:	791D070FF53E41DAD12588CC14F98D7830DEB89791FF78EF8A652B8076FB68454C4E3F1D3FA4F60A81D5F649B60FA5FE2F272BFB4224CE71D1275C15AA3BF706
Malicious:	false
Preview:	m..a.{nV...pm.2.hG.MuD.'......^..K....].x9I...%.:..r....E....:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{5fb7168b-b17b-81fc-a5cd-efac97cde83c}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.....n{....l$.-.2_.. ..s..U.....l...O..iS....s..7......W.....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office24FC428E-A37E-4996-AC66-8EA03...l.1G.c.."R.>.;.._j..6......K.RL......~...~.:..m.......D..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X...o.WN.E..<".9.!......:......Q.AN....)"..../.=..e...... .8../TM/v2" value="Office16O365ProPlusE5R_SubTrial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http...[t-WZ..mm.;.{...j".....(....y........~;....).0..:.........ity><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4B...m@5....7*.k.mW.!gX.~..._..U.VG.....

C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11953
Entropy (8bit):	7.119055385100248
Encrypted:	false
SSDEEP:	192:sVRSNpo+ROS77ol4F4aoK7Elig9bhYmfKP2BclndOE5L:8RevYSPo6F4cw8ub6juBwdOU
MD5:	804D547F1E30F33110521EF0E5BE8F8A
SHA1:	57165829B747A7462FB32419FB0CC0E709BDAA97
SHA-256:	2EABE6129418B315107752C4C8A1DDA81937204CE345E1580A2247A4E9A2EA68
SHA-512:	1866333731E293777F32E3DF82AD134069EB3AD20FB28E8777E91ECFAE67EA334D4258CCB421FA008FE7A440B7B9B523250C739F66E52F874CB6DCA6A78C9941
Malicious:	false
Preview:	V...$nM..B....1....-..D..c.YU..]....K....U.$.........5....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e8176cab-3840-420c-b3d6-.R/..ia..\D..G..a...\|L....i[ZB....OC[....\.}....{,.....x....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.5R..Nm.As....2...f@.OG%a.^Q....[.hI..G....(............d....itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365ProPlusE5R_SubTrial".[0..=my..b........3.....u [^..Z..EV(.......,....&......*...pertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.o..0..l3..W.....e...3f.k2.~7V^...6E@...V....{...........9....4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExU.0E...7..Ee.4.A...<r.g;9?9tp..r...rP.

C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11515
Entropy (8bit):	7.119862010376319
Encrypted:	false
SSDEEP:	192:hm3dzyfNTu96/ZxXrH1KSNHHVgeE+W7Fb3BR:YzaR3DXz1bNVgejWZxR
MD5:	A34274E6493B2761B96851679670E84A
SHA1:	6E2007CD207EC96B4F3DB7177DC904402127106E
SHA-256:	09187CC7BB4ADB1AEFA865B8050C882FD943CFB12FC86C31524EDF39C1859F44
SHA-512:	5751EA4C1BD090FC0F5C8B3B4DE2A5E1A806E3909344C7AE544622C51EB2ED07990ECD4329DC09738CA133316FFC406592948C5EDE427A764A0E710444519206
Malicious:	false
Preview:	.).;.../`...q.9.W..]T..J...........;.Xj.....w.,r...bn.=.@.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e7f11f5c-0e69-4242-9a9c-..C2... #.....v....^.....b...........5..c...E.A FS...4.)._.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/z.h(....rG..-.d.T..I...C._..........t.V>....a..e...7t.8.../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll H.WI..~b...f.8.H..\...@..\|..........u.^=...i.)a....z.0.Z.gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200...>.../$...!.h.8.8...N..uM...........].h#..G)O..r...3e.&.q.rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvVM.Ut...61Z..D.g.R..9...h..YG............

C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	34105
Entropy (8bit):	6.800070069571489
Encrypted:	false
SSDEEP:	384:7pPIPz8TfIhX7rgn3basON0/FVWJDczm7y7D5YDy6YKRYSS68u6Oer55tuX2p+cw:73nLFJMYSSvugt++eyl8LuQfx
MD5:	7BDC4E1E940BC67D90D954D5DE79B2EF
SHA1:	EE2B5183E1AF328CF2D0AA7ADA06D7A76E8C3319
SHA-256:	0695A45F3E36198694511A1B31F688A4E3D1B796EDE5D46730E8B053B2AF17D2
SHA-512:	2C609FBEBCA47FAEB8F765D9F71F2CD0E854472639D036045161909887E54AB189A897083931679ADA58B33CF72AC6C889EA4504724885FAE6CDC8704CC20CE2
Malicious:	false
Preview:	...e}.R9...Y...y..]c%../"...V:T....Y...0...'%u..............Y:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{2a9a2991-4b78-245f-e862-11366e07a43f}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.(Vx.Gh.......#...6`..~}...Z5s....#..`...(.h..............@.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office7984D9ED-81F9-4D50-913D-317EC2\|.jrH.u....f...F.O\|u..8!....Q.S....G@..#].. ~'........W..R15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..tkmrz.......0\...c.. #.....lQ....D..+N..7/}...W...i..../TM/v2" value="Office16O365ProPlusE5R_Subscription"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl=".0L)xQ."....C...7Z..}d........&T........~^..42r....F\......Griority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-884Ci...I.......I.pw.Ck5..r\|..QhN..2]

C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11969
Entropy (8bit):	7.095514487153219
Encrypted:	false
SSDEEP:	192:Eckmcqv7fluWaMGn1C6kEbkJ93EGXaXOiUx6AwLkdTzbpBf:Eck5qvMWa7n5bkj3E9XhKqEbj
MD5:	8F84A579781CC4771B382D38BAA97568
SHA1:	5276F0A278BB18DE03492A044C125EEA2FC28982
SHA-256:	E17AC11D4711510FCEA0FD7178DCE509FFFA3B488DE05B6F8D6035A87BB8642E
SHA-512:	025512362F93A2C3B8C5C7945591543AC4FC7BC186BDAC8EAC36E6AA2EC4475A48F6D8C823EE10251C7B583AF50815A045D02C4FA1C47E77624FDF0482E9B5A3
Malicious:	false
Preview:	.j\..GJ..g"G.=...fx...$...8....._1.8........y.}......{..N D..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{67d7b08a-5fe0-4ccc-9da0-J.....A.%u..v...('..Q\|..%.E....e(.p ......+.A.!....E...4G.Us:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/:....Mj5.>.x.".B.x;.Kp.........]nsD@.......t.v.E....b...cX.Oitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365ProPlusE5R_Subscript.........p)m.8...6,..Kk...x.E...<3)Z)5.......{.]......{.Gn..I:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.....X.K.!w..m...(-..E'....>...+>).py......v.z......D..>d.ZIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQR.....h}.Xs..........AF.....2...%..4r...

C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11503
Entropy (8bit):	7.076506576223906
Encrypted:	false
SSDEEP:	192:fm8sYeSIcX0MRotS30/o4jtEBZfDF6qeS:OdY2L9tMZbF6qeS
MD5:	D31B62DEE5577553FE96A438B067FBD9
SHA1:	947F35E0FD62987F2A346EDA8BCEA73018D5F3C1
SHA-256:	82952DEFA14C8B761471D3EED408E7D6FD6814A935F96EF7C50D00D125795B0C
SHA-512:	30AF60702ADC096A3571F1BC1217B333D1086F5DE98711B1C13AD207EC53A68DE4F2F32DE49D38891CE774D2D60F85F82032343099778D4BB652999475DBC86F
Malicious:	false
Preview:	2".R..s.d>!.o...gas6.x.OX.....H...=....?KA..+... ....~).trg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8379c31f-cc9f-43d7-825b-...WXz.'{q\a...)>.<. S.N.........b....}.H.Jy./.....A..3=. s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..SAj.S.vg.&3....y"gr.,.D.....J....p[.\.%E..Z......7._...,..r/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ..l S.{.f*-.x...{lrt.>.Sz...........i..T..M..Gj.....3..k..\|$. gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200..W..s. ;-.?......c...MN..........pC.S.~{..#\|.(.. ..K.._2..?rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV..n.J.[.5z..Z....n..q.")FJ....]....K..

C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11957
Entropy (8bit):	7.103486808480156
Encrypted:	false
SSDEEP:	192:AaG2agw2ACnnjH3vWB9DajqmgM36HyM7891LT3QnUt0PNAHhD:AaGr52l/3uDWbZ3TLt0PY
MD5:	756C170EB6704C0EAED96E203D6D693B
SHA1:	28327333270EDCDDF37D933C4F768B1E83BC460E
SHA-256:	6024429C39335A243DD348BEFF4FBFF4C28F7BCEEA38301445A582B27B52A8F6
SHA-512:	14021C4DCB27DE41A424B046D15CD2B7A4E7B092A65A67A32EF7AD3814022FDC7E542CDD5A143A094CBF1456CFAD24F1C7F62479D922AABCC285F33C9F0958B5
Malicious:	false
Preview:	.d%..!....S....L.u...+O..;C.8...]^.......a=......K..)....g.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{34d2153a-8afa-4725-ae89-B...Mk.[.....OZ.;D..Ws...&I.;.Q..G..G....#j.......!"9q....k.x.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/e..q+....b...]..kX..M.F...A.?.Q.....l...3.........\..0....<...itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365ProPlusEDUR_SubTrial....[c..f.Z...G.$C...7...2H...X..X..O...3,......m..5....aSd.opertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.N....i........F.>M..7x...B...X.M...O...`d.......[>.2....r m.z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExt...z.........>E..I..w8l...t...v.Op....

C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11519
Entropy (8bit):	7.103742651828063
Encrypted:	false
SSDEEP:	192:gwBgyT1kWpgdn0tllY3B8MR8csVbEyju2tQvr:hBzTCWmwRMR8VR3Qj
MD5:	8E5F215FF97657640335C782830F2249
SHA1:	2CA647BA7E5CFAFD2A7BEFDBCB62645DF1C2AF41
SHA-256:	76660244A258C2E70AAEDA9CA255E046B5C9E30C76C2F1AF801C0D714EC441BA
SHA-512:	392B219E85CCAADA76DF68669D1F0B3245618D0B0CFB6090ACED4E6898315BF8811FE15A1E051C94DD1E5C536D7E28C1CB6E2BE82933817D3A3F2FA4B2D7558A
Malicious:	false
Preview:	D..9-=,.......xu7..A....?...B.%.C.5..M6.U.S.-..R.hp..,.`.\|.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{cf1b00b1-c194-4a55-aba3-...ap&"..Y...n%y..KYVrM."......j.U..%..Ct.\...e..{.IG...v.t.c.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.z.J7....>....4v)...CZ#........a....u.X.,.....!..Y..?...6.e.&./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .I.Ks($.......qj+....H ..<....E.?.d..7.P.......<..R.{l...8.m.f.gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200...<==,........*.F...Sx...5.....<.V..m.W+w...c.g..C.hx...'.{.M.rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV...vj2........qp>....T.......>...\..'.

C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11973
Entropy (8bit):	7.075047636292126
Encrypted:	false
SSDEEP:	192:SC+GVGzpaJE32mqXO3HjhzT6hU5OWHhUvd5wVfP:SaYzpaJMVAOzFe5WHivd5ifP
MD5:	2CBA60707E50C57F3DB95BB3F3CB88BF
SHA1:	5ED870CF678561CE423ECD109CF6C7BB24CB0CBD
SHA-256:	F0ADDE051E974D4438AE2D4E2B6F1F5C710F21EB783660A385BA0C9B9C60C68D
SHA-512:	BA686B0A6C4F25AB35AEB61A492C42F8E52F4BF3930701C5076C47E12A1459B302FD006695C79382876F8E5F31C988B976BB792D134F036FAFD448CDE9E37DFF
Malicious:	false
Preview:	8.6>\.kd.."...zN.....o.,..?....Z8(.q.9%.g..`..L.P.....J...T..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{31aa947a-349f-4e83-b0e2-...;Z.20.S...Z5X...L.>.t.".....}g.g.f5.c...iW...l.m.?Ft...W.Hs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...-;.KD.N.*..'....G$.%........:l.7.M'.6..3..A.[......S...H.Ritle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16O365ProPlusEDUR_Subscrip...lA.:'.[&...ye...Z@>.&..l..I..h..{.=u.?...6..Y.L.-.ZI[......r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www..,..a'.QwW.H,....[@$.j..l..2:.c..{.d9.....6.......7...m...H..aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQ...z6.QR...S.A>b...X\|.....c..>34"..U.f].

C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20247
Entropy (8bit):	7.208912623419357
Encrypted:	false
SSDEEP:	384:YG9GVK7ZMOV+SKujfSEj8gt0POtNS0JPZJ9et8INe5Oo2Yh:UK79VHzqq8giWtNSsPZJ9et8IMh
MD5:	EA63E2A8E43BCA689429FAA24114BB8A
SHA1:	A1EDC1E3A6DF2AE26D5B111BFBF7BA5CA2B32ED6
SHA-256:	35C41F456F374980D914E3A924D5CA746F5EA5AD465FAE442C3278CC3284DD18
SHA-512:	B44FC067D0D9E5EC9D4AA44F726F5F24D45C8A3BF2096F2AADB0595CF28077850133A4A7846E926C8F9553E870B50E95CD9F9A41189FE3B1236E54274FD4F2A9
Malicious:	false
Preview:	.....0O.}.uz.).D.DM....%:.i...Q+.....i.W.....+..].py..O%rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{986ff0e2-bbea-4d2e-ae8b-_chD...?X. .{1]?....G..L.3'.:....d..7...m..V.........j...*4..Pqs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/}.G.....].L.)eOe.Z.P.....x..f...So.W....?.K.....+..b..aw...m:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProPlusR_Retail"]</r:aW.gL......k.i}C{.........xi.:...22.W$...6.@[.....p.....xq..EOossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200..:...0..q.%1C{.5.!.....30.<....2..l...a.}.........{...<M..eskdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI.d3.......U.D^.t.#.(..2..2.3.K.J'..&...

C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	29686
Entropy (8bit):	6.718230843449441
Encrypted:	false
SSDEEP:	384:+GeZsfaSMNx9oEqlmP1qJh6QvgXywhKPmeA5asAu4uQAvHhCT6ISbHWV1C56P3Hj:0Z7FqPIiwUskAvBJRMV/IA
MD5:	9B1F0501FEF0CC7FA20AAA654005FB07
SHA1:	C833C064BFA7F74D24D347F96351D735FEAB01CB
SHA-256:	436235768C114A62BA18AC0D452B79F145DAE9FF9A80AAB29E01F096200B9588
SHA-512:	F979F00F163A34152102BF527B7185128881471FBC8EFF1D05FCF29626AA59F0B612D03AE922E3E348831C9D1C9F91949C2948CED08BD40543F12973C6CB392D
Malicious:	false
Preview:	3t.L..........H..U.YX.(-.S.x.......9..b0..m]R..4...a4.!..{...F:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{7bb2ff52-7e5f-487e-ad1e-4fc9846615f3}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..[........K.W..M....:yP..,.@T..*....."..=GF..?...${.;)..i..._.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeC8CE6ADC-EDE7-4CE2-8E7B-C49F4..t2.2..b3(C=.D....KG.2<.D.y.F..G..1.\|\|..~.N..o....~,.+c.. ..M15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..yB.%.DQN]M.C.....!.(0.\.o.X..T..p..7x.v.L..>..v4Y........./TM/v2" value="Office16ProPlusR_Trial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www.mi..Z....Q..L5.j....;Z.[.EF.>.F.....6..){..-W..."...p6.&)..z..XolicyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-1...D.G...P.AO.........a+.y.h.F.....3..9F

C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	29687
Entropy (8bit):	6.6813617442116735
Encrypted:	false
SSDEEP:	384:oblWcrsgaVlvDF45n0ha1PO96EU26Nej8x6mep5pupGGI00Ri6S/W+wCFI5HeRGs:oIcroDF4BWFp6Ne4dgTGwL5ipZGoAOz
MD5:	BAAF46D072D06B37808F91027F5CD6DC
SHA1:	D2F7D7BB83AFA5917D41C309D1E40C61C15F87C5
SHA-256:	F3D0A61CF208B89ED1CD7DA19B44358B05D44D03489A6026682DA01DBFBAA412
SHA-512:	9433089937ECE6C2A69E1EC7193137A6B62303F5B59B067A5211F9A938D55EE9A01D9AAB79E635BAADA638EF945578A300AE3CCB1AC5F6606D1045AEBB694CB0
Malicious:	false
Preview:	N-H..fx.bs..D.'.z...:G..........".i]..g3...1c...W.rz8..+.....:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{dad7160a-9029-e78f-9cf2-0f789b5feb0e}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.....smB`p....8. ..!@.UJ.M..T.A....C]n.uC...%g..KA_75<.xa......microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeE1FEF7E5-6886-458C-8E45-7C1E9.....V_.U..{.+.)..m.j].....Y....%.a...+a...-C...^.mb=.2j.....15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X....JXP47....,.3..?l\|G.....Z...'. _T./#.../e....Pez{.^\...[/TM/v2" value="Office16ProPlusR_Trial2"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www.m....Rqs.lf.....7h...i*H(.P.E.M.m.}.L.1y..m:.....Cx~;.ee....SpolicyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-....\#Oz7....yFh..kUw........M.m.`.J.!

C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11441
Entropy (8bit):	7.072472644531007
Encrypted:	false
SSDEEP:	192:5PKu5Fnz6asMahjXTGLpVEaLzvlpWsYR9eVcM:5T1sMah+WYgVRUVx
MD5:	25F723D8E186CE67CA6C541C53A55421
SHA1:	255226B79675DF7391AA23D52875977851CD79BB
SHA-256:	DFCF3FAB9C9FCAD9E984D092851D755DE45EE87745E5568CAE7F1DD0021DAF13
SHA-512:	00B5DDB40071CD0F32B190EA25D6AF790E97A3685577565DDECFD82676BB07EEBE7801FFB86D5B31CB8E40DB4EE36CAC39807DACB9EF2E9AE91D5FC3FA931AC9
Malicious:	false
Preview:	..Z..<\.S..c.....95#.!...Vo.vY^.0..fPW..VJ....T.6.\|..H..s.Q..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d1b5a795-88e9-4684-1982-918eb23bb14e}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xR+...)I.Q......!i}.d...0.,........E...P......z.3..O..a.S...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeD450596F-894D-49E0-966A-FD39E{s..r..#.31....ha1.q...Al.!.K..7..`N...E....T.,.d.....(....15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/XM.....\|...U/."..rkc.g...Yn.".Q..5..)...M.....S.u.\|..i....i.I/TM/v2" value="Office16ProPlusVL_KMS_Client"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://H0..-R....w.i..4@_.,s..y2.L{...g...2H...K.........b..K..!.M..><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-}....u..F.5'.....9:<.,X..Eo.vT@..1...2H.

C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9927
Entropy (8bit):	7.101237716681122
Encrypted:	false
SSDEEP:	192:2H0uuWTmUbj/rVHAn6bbQ3j5y4BRyq0sfO:2H0ur/ro5y4BReuO
MD5:	DBB4FD0EDE0A92C771AFFF58C2F115C4
SHA1:	167F5EA887C2FF0EAA3146FCB913D5D94DC96DC3
SHA-256:	9585306B740DEAAF530C1327A6702251B804B3B457EF21B68D2059C0EBC782F1
SHA-512:	DEE5B7D77AC2316626956A71D8525CDD43A4DC5C28EEACFB562EF5577F65EA6A18513BE46A1DBF0B8FBA65E432CFE32AAD21DD152609ADD7B38EB231E32FA189
Malicious:	false
Preview:	..#..b.p..F.J.} RNN..5......[.-\|...O..].).$.,q.....x..N,.....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{1f8ecfb1-85a7-4605-89b8-.X.../R.]...D.26.....d..J......h3..D...Y.k..r.~9...r.OA.=v.....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.n..bh(P..w... lQP...~......T../8^.t;.......h.&w...:.?<..8...Q.r:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProPlusVL_KMS_Client".....{.DU.f.I.w=.....+.R...s...3{R.N.....-...."q.../.~..Ph....pertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.o.[...*U3....T.v=..\..+..)...d..j7T.N.....e..!.8L.....y]. e...[.4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExU.k.uSQ(..a...u.".=.$..%..j..hS[..!..

C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10943
Entropy (8bit):	7.181648940985928
Encrypted:	false
SSDEEP:	192:CocBwRCQEUxCPKstUDv/3AqK+g1DwNlf71bvNkb9YP71MSfqsh:C98CztEn3TK+KDU57NFkb9M71LfqU
MD5:	C2CED5407E601F3EF373655A1232D9EC
SHA1:	EC3114390984F4B0FE8D17214EB91666C2BB0636
SHA-256:	D8555694614247272BD06D78AB02C1471014E8BCF4F3B3EA1EA3DB86EB7919F4
SHA-512:	F9DB6EE6BB99B5A8B1992BEEC7BC9DB97D3296DD37B22629431BEED91D6113574802AF0041F9E6CA4D460D0C0410AD67608C7C3698BB3614EC491F5E5EA92265
Malicious:	false
Preview:	...................9.N.Q.O.cC.....).@....X.....u..p...~.;..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e62cb68e-e4f7-44d9-bb3b-;._.........a.Z...h..GG.E.`T.R...a.P.....Q....5\.1G...$..8.Ss:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/J.s........9.s......r.G...M.dG...B.T............~..?..d.6../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll x.L........../......!.D.s.G.1V.^...k......X.....L[..I..c..8.Ss="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bh.......#..1.....y._1y.n.CJ.{...I.I.........w..}...I...lPKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4D.\|.......3....`....A.[4d...L....E.t.Q.

C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11376
Entropy (8bit):	7.054140969840119
Encrypted:	false
SSDEEP:	192:X3nsAgbMPlIAHnh9asIkW0Xh+HKfQV/qdXsFri3:nsAgZAOsIkW5H2QtqNAm3
MD5:	CB7FEC5C0DF96CBD03BE725C7282B222
SHA1:	DE6DC5BB8C49F779366C6D3DBD488143831C800D
SHA-256:	E9673A2C22C38F0D63854FC3FE7C756E66D595696B7AEAE86B806398F5653667
SHA-512:	3798B70AD275638956E07758CAF9E672F00E04F4C36AC662C7453C08C8A4F321A5FC6B6B8A3667B6FE5F2BCC402C3C038DCABBB5DD05F8A24763FE88F2DE2A5D
Malicious:	false
Preview:	.%...A...P.g.hw..:.....Y`.JP.I..{Q..e.[W.o1o....4p.{...6w:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{3c791c79-000e-9dd5-0752-4ca01da16f5c}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..KL..T...^T.l[p+.F..W..S.:..\.n....+....AC.`:r..o...w.3...3n.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeC47456E3-265D-47B6-8CA0-C30AB...\|.......(P.lR9#..j.....X7._WAN..}OW.c..K.hj=...5.>=.9..'\|15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..i..a....X\.`H#).j\|.....N4.E.RL...4.S.4..I..;g...=...Q.&....+/TM/v2" value="Office16ProPlusVL_MAK"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www.mic..VP........6t.QN....KxI.A.5.AWVN...].k.Q...8;..=..z.5..4vlicyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-16..}........U..zPp6.OqW.....5.AWVS..::J

C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11905
Entropy (8bit):	7.0894160158405715
Encrypted:	false
SSDEEP:	192:b4W0fKFK787dkR2ivYBPaUPsTuSM4f+CYlaR9xDFkQncD:b4WCgJkjUPsTkCvheQncD
MD5:	AA09DE1975CC086582DA24026A34F870
SHA1:	7FD6F3CABD398FB030AD08E2A5C5BC061D8307E3
SHA-256:	E8E4E5B987AEE2D986CB9598E4D3495EDED9CCA4E4C69B942EE2A138DF1E758F
SHA-512:	2FB4F8BCE8C6B0F481D180C1A743AF08DE402FA85D0652041B202C1CEFDAC269F2AF001F9DB59D8E4D57E82668BAE1465FFAF01BCDD6E42FFBB445A1C388CFEC
Malicious:	false
Preview:	.Nc.0.T...iRxjJ..Gdz.r.s..{.P.n..0...\.J9.F.h..7.z.....),..G.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{76a602d6-65c5-4dae-a737-2..9.....>.v!....;'.#.+H.f...6..)...L.N7...>K....S....#Zv...X.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/....W.t...Xm$u...Y'n.9.z..[._.6..r..^..g.m.g..<.7.....j}....itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProPlusVL_MAK"]</r:anXml....j.J..2.$q....8.n.dP.{.x.s..6.....Vd.Q.`Y..+.o....}-...G.ssor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000/09y...k.P...2.YPd...5.%.(V.{.L. ....&..R.K.5...8.f../j...F.P9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI449+...h.t.._.MFh..].....LY.;....)......<.

C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20249
Entropy (8bit):	7.186432639870627
Encrypted:	false
SSDEEP:	384:mav2ZuMadH0Tp6pF7xCGVzm8t3ZyaWEJGPXhPT:qUMadUTYp3VzmGJ9WEJG/hb
MD5:	0F201B344BB2CE7225DEA74647524E2E
SHA1:	61E2E9778258B06F37622DE6590B1CEA43F08800
SHA-256:	4B1FE0F517695B3DB4162C714044E7CDE1279BD40231935A0DCC5CC4092E78E1
SHA-512:	17291A98CAA434AB3C2A590D70D0FBFD1500675977EE1536004C01E9837218F25DE9B1A688C01A8709B4E6EA51F80D078EF8F27BDE4C8501E5E3837F1E0EF9C6
Malicious:	false
Preview:	....b..L..c.S.6B.D.uW..BE..).?.'.I....p...v....g....I8P..T.E.\|rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{9189e056-025b-44db-b2d8-1..i.....7.]OyT...(][.....#.<......X.`...4..../.....~`n...F.(s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/W......l..R...k..Z.a.A.KN..+.8......h.r...j....g....v8B..Z...4:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProPlusVL_MAK"]</r:anX~>..-..SR.i..Qv^...)&D.....+.#)v....O.3..&.... .....T"P..M.{.5sessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000/#kd.0..SH.%..Q...-."1I.RN....5.v.O..\|.d...g.....p....7...Z.G."rxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI44y..o..ol.D.s^.i.$.c?k.wL..7..Qc.F..W.=.

C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11499
Entropy (8bit):	7.054976295619053
Encrypted:	false
SSDEEP:	192:RxkrHmz1Grz12xeQk/U4aLZ1qDk95Torh+18:RxkrOUrzoy/U4at4corht
MD5:	33915FBBECE65F33E2C0B72BF83CFDAD
SHA1:	43E29C350373A8576F5972EA0C1A362E4F66F902
SHA-256:	9676A7FC0058762C73503156CACF5953A540DF221172511C9140CF4128358CE4
SHA-512:	248C8CB3C98064E89A4FBCEEDB81B7E1FB7619D370376A6C4A1ED700963BCF52C1079D1313E5759CEAC65AB4A47509273D7ED32057D64ACA77597C041C34FF6A
Malicious:	false
Preview:	..s.~iG\.(v....s.xE.~'.QS..6ll.K.C...........0O..W.Nm,.n...Brg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{3b0756bc-6039-472b-b9d9-q"..v$.U.k#....#.'../...E..eo{...Z.D..........xs.tv..S_.#....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.D...cg\|.qG.....p.;Q.5s.Z...9kh.I...q...G..H...<B.*@..My.o..CD/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll 4w.k \|O..<z....l.uD.fa.Mq..a>y...E.M..F..K...!H..D.^yJ.l....gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200r9..niG\.-z........ .%Q.SE..cOd...B.....n..U...zt.1W.WY}.O.(.rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV1&.V9foE.lW.....v..!.e}.XA...iR.^...@..

C:\Program Files\Microsoft Office\root\Licenses16\Professional2021R_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28883
Entropy (8bit):	6.642241435885491
Encrypted:	false
SSDEEP:	384:7bZvGk0Uy8PvZzXRQr4QwAyuygKkrZ7pNNn9fwueeOyjZQN+Wak/AF68hVW5yNzE:Uk/zXR9PQF39jA+k4MDy7B7Vu
MD5:	272D51CE13EF766C99B7BCB43DCF77D0
SHA1:	46E9657E4DF63BD28FC0C8315114B582845FD7BE
SHA-256:	D501D80D1D1C5E6D3B2A9155149524C3620C61DF9A78DEA02F0ECAFEC581A6DA
SHA-512:	55072EBA7B4F80286005EF51B3A6E7E2A095654BAF5C7E766564C98A9605423AB76ACBC35CFAC5873180C913F8B2519BC3EC417747C07A01235FC8C748D23306
Malicious:	false
Preview:	.k...3.c..6v.7..n..}...1..V?9.dr..S.Utz<..k9.....7b.& .Tm...az6:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f5784dcd-da6c-d714-ad5e-774e8f623123}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..u..&.2..!j.3..4..#..e....em.h}..y. .hL`.q-.....!.Pi$.S'[..c./.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeCE5FFCAF-75DA-4362-A9CB-00D26.."..../..$.7..=.o... ..Whk.c7..[.Sj6n..!%...[.>x.>%..,Q.%k=15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..W.... ..q:.;..'.=...,...Aku.-$.....!2,^.2'.....\|!.&c.u.N..YDj/TM/v2" value="Office21Professional2021R_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http..4..<.b.!k.1..}..>.........e......Sj6n..#<.....lp]{p.T;[.}g*ity><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4B..6...."..f1..H.k......h...&8.03..[.Sj6

C:\Program Files\Microsoft Office\root\Licenses16\Professional2021R_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11963
Entropy (8bit):	7.095239308172508
Encrypted:	false
SSDEEP:	192:L144jChj51qmCCv1TubStPn3cl1fz/cpAi:Lqrhjfr11TESd3cL7/cKi
MD5:	C7B315067450D67C2F431059026AE85C
SHA1:	3871FA0E3A1B657DB49C803B9C3B56371C0B4239
SHA-256:	0FF926467A7C4D49E6A5CF83FB947F8D60AB4296B55E79F4CABF95B00B10B32C
SHA-512:	7D8A03719D050EDC4B4FF256DB7EC994BEF870761214CE8DB6E88AF062A5EF6578C5290317829728CCBF70054ADE93E2749A5D9A3FF8F576D709C0732E25B1BB
Malicious:	false
Preview:	`.o.......z.O.(.....-.i.a..vi).'.b.L..M..wG..Q.'I..=..!..b..'3rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{84710d5c-affa-420b-b839-..........1..\>...V.\|.1.w..%j>.b.{....C..5.....ou..W..../..8gs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.z.......E.PNd.....f.`.<..yn-.%.'.4...G.%l.].1B....8..3..n}itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Professional2021R_Grace"..........p.T.5...K.3.~.d..^k".9.,.....D.sA.Y.'......s..}..&fpertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.o.O......p.J.5....3._.I..If".`.....].;L.....O..5..#..n..bs4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExU..........z.w.....h.<.I.@..GD..b.%.N...

C:\Program Files\Microsoft Office\root\Licenses16\Professional2021R_OEM_Perp-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10995
Entropy (8bit):	7.111507725924829
Encrypted:	false
SSDEEP:	96:RW3m7He6KZDnWQaZjEqqaFNBNOvg8c4gRJXl31NbkDW5EWEKs3lWF9cD6ZfRLzW4:pG7QjEMmg8cVvddEodJLzw7d0DbjN
MD5:	296EC7C0B45B4847D8049AF6EEA34485
SHA1:	0F91987A60A13BDF1E9ECDF3197F266481E2C3F6
SHA-256:	3726CA211F84A83EFD646B8C1612DDA55984FCF4D41296C772AB1195DC1CFABB
SHA-512:	EC21F6C3C4EF54F9399492D1B2E4A86EE36E02FCDB7DCE983F3812FAE54E11D18175567D4170C929E0442F641AEF174CA838B102D3499A1B0B03CD0E9030117E
Malicious:	false
Preview:	...t~}.>Y.ta.......T.d....r......#.....~Y.I./B.I2..-X".J..!.2rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{3a76c482-ea3d-49c0-ab8f-&;Sqr0.aHEt!.........<M...!...JC.5....<....}.)...........".fs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.Z(g.w..KXE^..........m....}....K.e......dWNB..N._9..b...P..,.4/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll 3i.. h.o[.x}........L.n....%...F........0L.L.HE.....L>.W..".fs="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b#CQ.'V.:IB!D.........u;..?q...c..+......5pE..{_8M0.. .j.}....YPKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4.i'xO.6/B~T........,.q>..Mo.E..3.....

C:\Program Files\Microsoft Office\root\Licenses16\Professional2021R_OEM_Perp-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28888
Entropy (8bit):	6.740729295481875
Encrypted:	false
SSDEEP:	384:Ln18dCM/UxXpE/IOgEfoZn5IrMhhI79DN17GeeHBcFB0vSDH6Oqh1Weu8L4HXScU:rdM8XCILOghWRDbyboDro
MD5:	792F302901A7032C65F7A2BDD7A11442
SHA1:	BE48FB5F2A7124209EBED261796148E298B1789F
SHA-256:	82692E34151E8349D7C9213F36111514A5972F61D577FBF7A766AFCF2971048B
SHA-512:	437860915F4B3EDED58092FBC59662D88F93A9AC702E2BF46E0365BDB18E3AACA52D73B77919B1A4068D9E8CDBA16C3101489A76F3DD30B64669D48A06E358B9
Malicious:	false
Preview:	....;.t...I..N......\|v...![.A82..ZT#;z..WX..A.c.E...$..Wc.W:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{17a207c9-258f-269f-2851-6db61233a183}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xZ^,....%...U..Q......9d..Q~...o>.!pTVAh...C\...../.....n..Za.N.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office6986E2E2-307D-422B-90E6-17B46.p...z.8b....B....,l.."Z..-5...R.%%6....Kx...A.y.]...e...'.\15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/XE......7D.....E.....:v.. L..7{..^.Vln2....I^...F. .E.S...[../TM/v2" value="Office21Professional2021R_OEM_Perp"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="hCF2..l.oE..R..N.....1;..1...].C..7pVm+g....A...@.7....."...,.Kiority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845.....n.Yq....F....m...Rr..Ce...._.Rw1

C:\Program Files\Microsoft Office\root\Licenses16\Professional2021R_OEM_Perp-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11956
Entropy (8bit):	7.037098004359531
Encrypted:	false
SSDEEP:	192:nNAWEVqK52AavZsRnrHCqfnGOJDSiAiHsCVqZF20X5J:KWri2AOs9uq/GwOiAGVqLxv
MD5:	7B493169E2FEEA3EE1ACFD8E43BC04BE
SHA1:	6C8B3EC6ACF35BCFA2521421EE52CFFA44764AB1
SHA-256:	2FD6E7BD3E4785DBB3CF265A60228A39EF7989D415AA08BE03E1DE7BE01D1E6E
SHA-512:	12B15BEB0CB639A6B5DB1FEAF576E98E59045132632E8EE18DD96ED9847D3749002BC8545BD70DEE5608D64362DBCF00F12ED72E32821839D32B661F58EEF6EE
Malicious:	false
Preview:	.s.1....EX.JY.y......w..t.&......f.E..{k<+1....G...1.Si..:..JG.Wrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d40d686d-3f1a-456e-9705-F..5....S...W.6...KJ.&A.8.;....^U).S.ke8%sT.....,..r^'?I.@^D..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/`.U"....W..u..$...W..<M..B.....^.!...y;muc(...J..I\|.Tdf.y.\.[..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Professional2021R_OEM_PeV.:P...@.UF.n...VJ.:W.&S;...z^.....?;pV/....V...1..gz.s.B...WpropertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w..w....U.....n...VP.v..&......mS..F...;fb/...e.....BQE.t..h..$y6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRla.M....,.....d..jt..t.):.....cqQ.D..#{

C:\Program Files\Microsoft Office\root\Licenses16\Professional2021R_OEM_Perp-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20300
Entropy (8bit):	7.170749804725087
Encrypted:	false
SSDEEP:	384:NKUJf4zF49yU1LA+cUe9akJyIzlKiApLFvSS:ziWyMA0iyIBS
MD5:	CAF1D8197AA53892777B16A1A7A58FA3
SHA1:	DA269A2FC4C6DDF7159C31619F82721D7634700E
SHA-256:	C02BCB52025B649DFAB23369D73D29884539C1F2BD72649252C756367001B80D
SHA-512:	24222EAC4752004ADA72D552686BD440B712C7EDA277A31EC7D5E1FBA71D8DA6F21D5A02083C0FEA445F0C821B3FD10DF7E854CA2BBD79DDF006778C0F1598A4
Malicious:	false
Preview:	...;Q.ME.....z<...;M...^L.j4....3_:V\|C.e....._u..U>.....iYZ..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{a8cc83ce-f078-40c0-8a9e-.K..5.W@]...T5..VfG.E..Z.`g.....Ir.lM.k...I^.I..?.....V$MY..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/./f.\[)mW.....'p..J/..I.U..h;.....v.B"~..6....._u..2d.....g...:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Professional2021R_OEM_..Y.&tX.......y...Jp..T.^..!/....+U)R,F.6....Y.[i...).....mQ...r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www....k[..W...F,}..Tq..Z....\......&Ub.`@.6.....QVZ..e.....j.F..aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQ..n.Q[3{6..O>...ir2.^.}\|.H......{G..O

C:\Program Files\Microsoft Office\root\Licenses16\Professional2021R_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10987
Entropy (8bit):	7.089556542557808
Encrypted:	false
SSDEEP:	192:LSTMJ0RRDoQyeD8yHDOKxtcJJ5k6d8EA+TdT:GTvSQyi8yjOkqxN8IdT
MD5:	ED4C179C249101AF8851FABF67BDE23E
SHA1:	3D135484580563AC1B2660998CE6FEBF4B45A121
SHA-256:	3FBE74794AF67EA0C49EF658F14218458BDBB6A3DEFF7A1D99FDC3919B70825C
SHA-512:	29CD684BB543D4EEA5FD11E84EB01C608D7D20ABE50A405208FFE695C23CE1B1B5416C929275C7FCC2610E5460FF39630050CC067AB73E83AA7DD476B45697DF
Malicious:	false
Preview:	...S...:}.V.@....Q...`.Q....&.....W.!.L...`...@h....wmi ...y'rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{cf7b6160-13b7-41a5-a54b-.l^\..E/m.A.......E..8^.....%..N.....1.H.Ki^]I.T...2./S.z..fss:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/....4..0($.i._.L....R.4.Z...!....H..aM....4.M4Le....M<:...#!/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ..q...A8i.J.@....\.T.&.M....t.B.....gD....`...J8.....cq<=..fss="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b..ln....*>.s.]. .'z..!.k.......g...7.(x3..5?S&O]E....2%;...1{LPKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4........L>.c......7...x.n........H...0.

C:\Program Files\Microsoft Office\root\Licenses16\Professional2021R_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28886
Entropy (8bit):	6.663550822158774
Encrypted:	false
SSDEEP:	384:XAwxJCUkQewd/w7QfwyUVwLz9bphvVwuunmeeEQVXzNtRIy6uhJWCJ/wfKvnlaXK:w4DwdVGHhvVw9+NoUD7cPk
MD5:	10AC87D20A2EAFC086F99BF69220727E
SHA1:	AFFB53CD0315CBA956199D4765077ECE7328987E
SHA-256:	CF6DED984EF965C7EA64C1098A65893A69DCCA4DC99F655CE9AFA46A628EBB22
SHA-512:	A423BEBCC17CC7E91B9FF89159D5EAFC79793FA1EC8067E321E59890B46F28CB961B0B9A756482BCB9532A6C3BBFEF6B01C0405847E5249FA525A791B345333E
Malicious:	false
Preview:	kD.a..Z}BQ.....t...Pe."...0.v.t..C3.r.Dpz.v...E..$..P..B..c:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{494f194f-6c07-f60a-4fdc-2c3231d9231b}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.;.....AF......l...B1.s..\Jg.yXE..6I....jn.y....._. ...T.O.z.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office711E48A6-1A79-4B00-AF10-73F4C.........dp.....%...Jt.5.QL%.3xa..E-. .W:f.q..._..!.M.^T...h15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X...o...+.......?...Px.-.RR?. z:...f.b._)d.f.......g5!'Aj..?/TM/v2" value="Office21Professional2021R_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="htt..zr...0]W....x....4R.n.."<e..F/..Y/.?..:d.z...[P.xM\.....brity><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4.bp....p.....n....N1.n.U.8.=iy.../.

C:\Program Files\Microsoft Office\root\Licenses16\Professional2021R_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11948
Entropy (8bit):	7.0478436329736285
Encrypted:	false
SSDEEP:	192:BSKC+GTOW8pg06HfpWAAviIhzexM1V6rRYq3oTTNo:y+Gir6B9xNMeRsTpo
MD5:	1A2C85E8507DA50A295E9E8FF1844B6D
SHA1:	01CF4E8AD64557638F1ECE0BB57E6DD20C162E73
SHA-256:	E56E9561AF3705A7CEA1B6F4115483D67DF246BE1DED2B03D8CFDB12B8B9EAF9
SHA-512:	94118E55DA6EF61DAA26F7AC0F96C21CC8735A6BE5FA3DA3C9D57D20F04C82917AC0275C92E59BBF8B33501EA1A31E181F7D3DE044DA90A82485EA440BF08A7C
Malicious:	false
Preview:	..B.8Z..~..%....8z.L...V .If.DS......m.W...H.)O.X....)e..XIxrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{3f500a64-07fd-41a9-acd4-.\|..dC.Bi..nq...h4V..K..l.Tl.GD.....T..c.Y.......y+2^...Z?..[V,s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...._P.<l...#..;dJX.Q._+Pid.CW.....d.=......E.".OOx...j4.CD.6itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Professional2021R_Retail....u.......t...v+Q.....<T@m.kX.....W.........J.".E~}...+#...J0opertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3..=..5..@q..xt...v1_A...a./mg.\|U.....\|..'.........T.HB..{S...Ctz4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlEx.=.gTm.Dj...~..J.[ .k.u.#dQ.rw....K..k

C:\Program Files\Microsoft Office\root\Licenses16\Professional2021R_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20292
Entropy (8bit):	7.207685755452135
Encrypted:	false
SSDEEP:	384:unCeBSOkdYPyBmWqSKQth/W5x27ycIzuuqRFwwd:ak2yBmJJBqycIzuld
MD5:	CD3DC2047D45DB6FC931504DE3F48DF6
SHA1:	531D1E0368436C94E6F507AD8E922E2E4BFFE2A9
SHA-256:	F5F35E6AADC5FB217D2888AB115DBB0129F55E1A5C70FB9673D51A1C62BDDDDE
SHA-512:	C67C8075DEAA176823BEA68373A1CFCDB5D57BB2F8769031FA0E9A7469115B06B2EAE658ACEC3FB5C73865BF31A6EA35D4D5869976D36AB2089AD6A5194EC031
Malicious:	false
Preview:	.`DvN..(J.e..gr..y.T..L.....P.6.w.v......F....`..M....6:5.....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c0a82180-fc9f-4985-87b7-F.xC..s..4..,=..&.^A......S.n.8.`.\......K..(..d....Io...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/g..e)...X.T..x/...:..[.E.....W.n.0.0.w..S.D.=..`..M....$v$...\.:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Professional2021R_RetaJ...M..~..X..Ke..;..].....G.Q.J.n.,....I.M....K..M....6s).....propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w...8..tZ./..!e..;.......<.[.].n.u...._.TXO..l..p....,t\|.....y6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlf..8&...#.4..Lo.....p.z..0.mCS.@.w....

C:\Program Files\Microsoft Office\root\Licenses16\Professional2021R_Trial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11499
Entropy (8bit):	7.160284947526414
Encrypted:	false
SSDEEP:	192:C1jRovc85kewfN7czeW91qbRu49P8Qh2rpqLl:0jRA5k3FGh91Gu49Lh2MLl
MD5:	1774A2E0B5EBA311C62495C9F06D178E
SHA1:	211CFD3B453B9250C60A25BE2342D574018DDCC7
SHA-256:	A8FF4260E478484534C809C76F4EA7B9ABA9B7A62CDB8F762A19A2C7CCF372A9
SHA-512:	0FA00B1C20EE9903FCE5BA2851B677323409CE7E3DC56ECBCB6CC5F024A85F13AC599D863741D8F2E4F1B300A2A7E24D4E121301DCD74BE4C8304A0CB1B09A75
Malicious:	false
Preview:	....K.......Z..........<.o......`T.p............\|.*.....v.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{bc7fd2d2-ac62-4bb6-a343-.R".G......X..........Z...!.<...R...(..~...P.......'.].r..].i.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.5..,.....!.E.......V....`......[...#...U......k.w....,./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ..2.........Z.......D...?.8...S.:!..9...V.......o.:....l.gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200.Hp.[..B...........t...6.:...@..s....7H.......\|.3..1..G.rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV.W0....W....I......X.....w.3.....,".#

C:\Program Files\Microsoft Office\root\Licenses16\Professional2021R_Trial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28990
Entropy (8bit):	6.755781838093204
Encrypted:	false
SSDEEP:	384:VI4cEU3WceGu+v420FWG16wNuMN2OuCCZ1tzEx4PcSAuWNKnVqUDhDk7wfiPlx5D:+5ekQDpNuUhu/BVq7VvMDaz
MD5:	A4731D0EBA293E3C4E9EDEA3FFBE4DF2
SHA1:	3F36E708E76AF4A96C42EB5DDCB9EA52465B587A
SHA-256:	8CD0B0B6670ECBD2C5A6436900226B571D5A05A6DCB576FDDBC643D52197365C
SHA-512:	02E0714447BC0863EA2B9B3139993AAF380FEF178C49345A873FCE58DE57A06E6CFFA58CBB10472E0A83D6B502600D13FA51A99D42DA94A1091FD75B96E768D1
Malicious:	false
Preview:	.h..@..Q.3.].Y.!...C.hBIh....0N..j........U.b..(.2.>.......:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{262f5912-58f6-66fb-be98-581fe600aafc}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x....E....$......}M.Q.<..<.+_.?i.....b....Z..^.d.}.9........microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office49CAD824-F064-4F4C-BB38-02565...:.Q...._b...u...Y.oUJi.-..uI...l..._..R.0..2.*.s.N.Q..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X....P.(...tA.&.....S.C.kMH..3..fK...%...\.L..E.j..k.2....p.-../TM/v2" value="Office21Professional2021R_Trial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http......KP..$.],.J..P..1.)yTA.#@.^....l...]..D.x..:.o..>.X....ity><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4B...>.S...cJ....\.#...R.)RJ6.~..qB...l.

C:\Program Files\Microsoft Office\root\Licenses16\Professional2021R_Trial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11960
Entropy (8bit):	7.039274890870258
Encrypted:	false
SSDEEP:	192:I5nTFtcv0UfvxU3DgYSk1dHBUDOYgD1g8KPRC1:ETF+8WCgYSkTBEba1gvpU
MD5:	FC7FD8A326413038FC09E6982E1F88C2
SHA1:	8FDA7321DD1AF3A4B45F9B305F89A12EA30E3473
SHA-256:	FF69E91D5CB8B1B99BC5A104AA94AF5D854EACE609C83EE1A1C4C0A0EF0D0038
SHA-512:	37960E8C6292206B62823509252772623955B1958FDB829EAEB2BECD83BF84D08D62645B55D2769CF618E0407577E5E7047366851EEB07D55289A57A7A6AE956
Malicious:	false
Preview:	t.X.J6A."+....+)......9n)b..@ ..%.'.(.2....>.eX&...+..7..:.. .rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{0ef0f788-6b4d-4dfd-9cb6-...Q..hO.2~..=y......ux4h..Wx..<.o.8.6..h&7..$%v...cZw..?.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..hK.@.a.{.....g.....23.`..Dx..`._.*.c....1shN-AA.,...SQk..i.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Professional2021R_Trial"....S5u.8.....6g......mk)t..K#..k.e.K.`.....wkXuC.+)..e.D%..!.pertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.o...V..k..ma....6}.....F#...Kh..m.e...y....; qe .>.3.5~I6..e.4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExU...7.{o........Y.......O.>..eM.b.%.3.

C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28869
Entropy (8bit):	6.743141780489448
Encrypted:	false
SSDEEP:	384:gsh5cU+N3kZ0dXM4m4uSuz2NHW1dVrp8oeeCfquhZe5GvktiSWaLePvoz5f/A5Td:BQIOLHUnrpWnfeCHM5f4BN3
MD5:	10CE91B38BD47CA387A00A9D7ECF9BB9
SHA1:	1239C325B25065A92BBE27CF60A305E4F2C80176
SHA-256:	A574D07CB1635EACF86FE2F66D500ED045E143DE4E1D6D012849DF292E31D653
SHA-512:	D124E2FFDD4B169B409EBC8484C8EB4F59B10833975CDEEFB7CB6447022E5867129574747AA8E9B4970769459DC7EDBDD2F06D86A4045E74EA97A780251D0306
Malicious:	false
Preview:	.b{.....%p......c.qpelH....P.=k!..I..O.(:...v....M..).....@:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{3bad001d-1b9b-1b3c-c147-7179dc6e55e9}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x........&g.....?.$5w8.\K....1d...I..].Gj...y................Y.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeEB264A11-A2EE-4740-8AC2-3751C.....F...Q......7.n .}O.....:.&........)..q.N..U..d..O...K15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X5.....?..a7.....=..6eqK......t=$.K....y!..f....M....q..../TM/v2" value="Office16ProfessionalDemoR_BypassTrial180"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns}........i:.......1..!oR@.....R.{..).._.Xg...+......I..3......./sl:priority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7Cs....._..."...!..d.tf.?.VI....1u{..^...

C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11989
Entropy (8bit):	7.1006946857674365
Encrypted:	false
SSDEEP:	192:/cM9NVyMfYUDdHqDwJObtt87lYDWYvCDI/SlW0ygD:/XjySdHqkJOJt87CWYqDIadyI
MD5:	3DE39A39A39C94E4295882CED84AE30A
SHA1:	0A47F175C132D273D412E75FB7628142EC0B1774
SHA-256:	ED892835874BEC21EF4672219AE73A97936B3C703B844195C61A3DC370ED84EC
SHA-512:	B6E43F99A172095D4ED4D6A0D57FA08F2453079FC3AD7815C9F726F68FCC7697A31488CB2A1BF1B2B3088BB7CBDD6EBDFDB103E0DA7E4640EEE278B4EA6EE93F
Malicious:	false
Preview:	&H.............d..ym=..\{........u...PD.@.+...N...i.".....;[rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{1782928a-dba8-40d9-aae4-...........F.r.F&0 l_P.m....A..cY..^@..."L..[r.,@.^......$.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.....2....D..(..:ynvS.W&7...A..L3i.......x...E.H=.d.;...r.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProfessionalDemoR_Bypass....K.G.....^.d.G$.boU.Ak........\|N..D.@.w....L....H.?...8.d"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http:/.....L.....YT.:..qlbrK.Aq....v..1vE.......\...U.^..o.%.....".1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0....u.:....8+.>..c.h-v.}U.....b..8@...-

C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	29235
Entropy (8bit):	6.731341894674611
Encrypted:	false
SSDEEP:	384:9EpJzT1UVIkz0F4vrK3B3cCEeCNS/ut64LePs3OuayMFftmyI3DOBKQAMVluc:aDi+R3lBS/tXUuEFV8OmMVr
MD5:	99BF60D959B343EB3D96572554F103EA
SHA1:	B7B77F207DE0040BAD1CC281554CE9A311A27985
SHA-256:	438B06D986E2C94E3FFBE3BB8E4929EC0B9D2F5F0528D17491E1E31542797EAF
SHA-512:	6096887B9CFF1508DBF89B7E7366623E77092D6EBE12291B32C2A3EC7C4D237A12FE509CEF90A827AA537165C97215EFF7724ED674AE2E0DB1331D5C904D2343
Malicious:	false
Preview:	..Ih-W.0Y..g........f(a..T ....r...Rd.i{(e.po.....UO..".5...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{da7da819-d97b-dd0a-a18c-71eb9846a2db}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.@.'(B.a[..{Y.....#...t\|5.S.z.M..U...'....x..t`........%.}....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office2A3D3010-CDAB-4F07-8BF2-0E363.n.bP..\|)..5/.....+...\|9f..Uw....u...TzT;};/.Ph.....JW.o.w....15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.a.f={.s...+_.....!...f5b..Ct....w...1Py3<.v....BO....h...^/TM/v2" value="Office16ProfessionalPipcR_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http...#eX.1...z......!..... ..}..R..(...TzT;}-.v~........".}....ity><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4B....Sl.qH.. W.I.}..wq ...9....~...TzT

C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11963
Entropy (8bit):	7.086056942536303
Encrypted:	false
SSDEEP:	192:crpUvFStN2SQqw5pWZfLE+0+gR8xHVOJrdHWO6ONM3:USzfqw5pWpE+gR4khWOPo
MD5:	A30892FD5FC095D25811A8BA83091B79
SHA1:	FAB1E6B19DE017AE9F496A8CD4906C5432C5789B
SHA-256:	9875144B072793434672E0012BC2E6E7F99BCE016DD849F429F121F9B3A67D71
SHA-512:	EF0E7147F38D7E36E99EA4234590284C28499939A0B7738F76F1A5E8626255C55EB9E2783D748C72136734ED0D4C14F518163F0254D437D38D55341883B71C9A
Malicious:	false
Preview:	,u.ue...t\|5.q...!....i.4.Ii...aA...I.4T.....Y...j....n0.'....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{491d2eb9-cc77-4b31-9957-....,-...7.&.:..oV..1.x.Tc...9.......:P........<\.....PC.j....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..:..o0..-M..n...?J.=.?.ik...9C....=.d.M...U...9....ws.v..].itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProfessionalPipcR_Grace"..X.p\|..n\?.j...jW...f.`.I....b_......g......Q..S;.....<..8....pertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.o..X.z-M..;6?.t...d........Ct...).......g.\.......z....l^.+..Q.4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExU..-..TI..)[5.I...`z.......u5.1......'.r

C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10995
Entropy (8bit):	7.100155408633431
Encrypted:	false
SSDEEP:	192:8Gz50dVpKnqR+7jBS5AZzTGRYobSxdUQ4UfZDR1UHOZ:8GWd/ybhS5KzTGzbCUKZjkK
MD5:	A6DFA2C480B3E0CD4ED93DACD595C2B4
SHA1:	0C33C433416150B82580BC7D85FB17141F68FAA4
SHA-256:	613553835F73B27123F5DA65701D5CD2251C317C2A17BA8C2907A7807B984F17
SHA-512:	21D2B7EA1633B26066590618ED7B599E71A5A2608ECD5C9EDA2D6F23B28023556B56A34908A346183FD13E80CE8CA5AC43C82B7E47ACB87C8890CC8081F7F528
Malicious:	false
Preview:	s..7..\l4..Y...0..}g&...x.../<......fO+Jhv..d"......l..._..(.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{ec78a974-e9c4-4354-8d07-..W.i....z.NW..`1. mw..n...-8d.^.....hK%.?..C6j/....46h....7.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.3..P..\|~m.;....3a.i#m..%...)+d.U....L5.dPf".SK......1(N.^..r./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ..@.i...n ..N.../c.\|%>..Z.\|:;......J<.).}v..a(C.....x.N....7.s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b...n..X\|w.!z..."...`f..P....&S........0C.A).80?>.....)@I.h...PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4..p.c..T.w.1H...Z+.\|d^...M....}r.....v

C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	29240
Entropy (8bit):	6.74315962070697
Encrypted:	false
SSDEEP:	384:Ll5zF5UlUJyw7Be4LuyABVEYQWopFaC6Wzgc3eP6ljWiDtNMH5BWGA3s4/gSqjAR:hnyw7T2VuWo+UzFzQiDtav74/SAR
MD5:	77120F95A2C724163004F1EAF1895AC3
SHA1:	5232FCA81884C3601206EFF59A74A39AE1E79343
SHA-256:	954280D4EDFC1669E41674AF24CA742C783EEC76FCC7E239C9368C9F18A680ED
SHA-512:	EC97C2BC2E187434F89FCCC026476909F8E7C8B864B0AC6B36187D7731BD005BFD7ADB1D60B26030149A341A5D3C9298BACC737B2F1C9AF6FC5320D489776DD4
Malicious:	false
Preview:	].{T...t......9..g..8...4...?...>.!.. .)._f...........0...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{700dc3cb-ca0d-ea44-2f2a-3636e188d1a7}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..v4Q...v.....c.9....`.P..0..>.[..O.3.[i..N........".(...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office4E26CAC1-E15A-4467-9069-CB47B._^.Z.........j..u."...5.V.z..g.?W.&.c..a.E......O..k.n..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.%TuD..."....p..'..8...#.H..i..<.tS.q.p.Yv...U...#..U..../TM/v2" value="Office16ProfessionalPipcR_OEM_Perp"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="h..h}D..#......k..g..u......../..<.1.. ..MFw........A..~.e..iority><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845.\Z.\.......GF..q..Z........r..j.mP

C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11956
Entropy (8bit):	7.105680032012858
Encrypted:	false
SSDEEP:	192:YGS+qOJ85uEuBy71QtkqGies240hHVUtdHitHD1k3znqVJOG3aYSF:++qOQ9OkDihn0hHutlL3bqVQG3JSF
MD5:	91D554224B890EB3953336FAECE77794
SHA1:	F1427BE5F3C689B548E88BBEF26588264D2F7DB7
SHA-256:	56104B25C72A58525350F32B823E2F5D7041482746FF48A4B52186E0C4DE6E76
SHA-512:	902360DCD78D963D3B356DB2FE17E93ABC49A8F4601A0142829877713D9E2F7F56DA73399C2358426B6C701A2FF5153A9B867AF443679AE8294110E5AB5E3961
Malicious:	false
Preview:	.\%....c..s@....!.V.L....E.7...OH.,9q...u..B..w. ..x...+l...)Grg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4d85bbe7-46d2-4aab-9040-U......'..9NN..\oV......X.d..O...:q....{..K...?....Y...X6.:.6.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/r.....q.L.....?JB....e.8..OM..jA...+....a.s......h=.m.`.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProfessionalPipcR_OEM_PeD......."..l_)..CfK.....X.8..k.Q.vfs......X..\.>.(...bp.\|.(GpropertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w......s..1.C..]gK..M...y....\|.Q./*u...<.....{.$..i...e%...;4y6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRls........8....`dw5.,...o..>.r...-Nz..

C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20300
Entropy (8bit):	7.2323714732317015
Encrypted:	false
SSDEEP:	384:v/2cI/or+yf8LarAh42yd5Sg4eQy9SepCP+eSRANx:5pyywarJFx4lyI8mPj
MD5:	988624EFCB495068BCEFB8E8ADEF3292
SHA1:	F8FDEE111F1DD96FA4869005752DA13654A1C9E9
SHA-256:	AC287FF945AF8CE1A2402CDE58E578FBF5F10E3498AE018273EBB6B4AC99E846
SHA-512:	4DFE0BB5FFFC297A2650D8598B45DC27EAE27B871F18564DE4C68252BA374C79D722D04BD3A275551F4469DD4068F42566B1FE20F8D391E761445B1FFEEC3215
Malicious:	false
Preview:	..C....Y..E.W...;E.;..F.S..G.o...r.f.....=e).fX..{..R....O..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{2de18f2c-d872-4bec-a367-.....e..M.......P.d..j....N..D.....:.v......k<{.Zn-.Z..l.Q..L..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.-... ..K..z.H....xQ.p..M.s..@..m.\...d.......e).fX..!..@....Q.:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProfessionalPipcR_OEM_..........Y.S.E.x..j.F.......?...a.6....=,<.ze..l.C.....@.r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://wwwc... ..K.......E.f..p.......h..4....z......$.t.IBW.Q..u....S0.aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQ..... .........O.[..T.e....d..u.).....

C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28878
Entropy (8bit):	6.684655276630487
Encrypted:	false
SSDEEP:	384:q5rWgUdwr4HxQh2NDe5zPE4pRXmJK6GsQl1MVIMvGfbZoeeZVZnQ8nR/g6phbd25:sWlR05/76GtkGMvGC/f9lwDG0aJq
MD5:	F8C6A7A605458857F6F366591FD4B2F4
SHA1:	4559E1E994D90062B4B63ABAB23EEB918A713F36
SHA-256:	D38DBC7877B9CE8641A14FF5120AA47061A6982B2041A7DFF3B0016FBE155C8E
SHA-512:	F334F75A9FFDF44EF96C4CE150332557E861C314F060BBFC330D5893FC93ADA14B49C8DC9DFDE8847BBCBCE66D7AE01E85B6F6BAB7DEA6F5F0B6F9A213FA8ED3
Malicious:	false
Preview:	.Q.....jyR<,.@...a.)vM&...#..&...j:'.....5.u.P.L...[...z.C.vS:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{776f2c06-7a48-6fd3-9d8a-c872872b9dde}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x\d.....hzE e.K...?.ld.r.H.y.O*."4@:R..../.q.[..........2.N.sJ.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office7A0560C5-21ED-4518-AD41-B7F87.J......_sn..K..s.yl\!...t..!...bc!.......U...L...C...8...gX15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/XCE.....<=.pc.G..!.ovP%...w..o..K#8h..l.s.Z.KR..[....'...H./TM/v2" value="Office16ProfessionalR_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://wF......9`Q:q.C.....S$e..W....).NM.{%....f.eF...@..Z....g...}.<sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-BpK....~M.~g..l...s.x:.8...).6u.NM.{%.

C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11943
Entropy (8bit):	7.11878606447565
Encrypted:	false
SSDEEP:	192:TxWrJU+EnU37WFYtWmZL5H7ZOqTgzOHsmRqBIft/iZH4:CJUDezkgbPzHswqBIV/i+
MD5:	49735B1072A2E06DA14B4723293437FE
SHA1:	A2B96C14B8184310352CB1FC0B22D741EA7C80AD
SHA-256:	E87C58DE8411E4FDF8C3791D13D1042E9A9AEBDD5E9E89DA201DE44BCA3B5F71
SHA-512:	873273D98813672DDF9DEF0CC2CFD266621564018B88D564110646DC975EBC305A7A76EDDDBAADFF4C04157878D50A8F52DE8166A5FDCA6CDBB2E56B9224378B
Malicious:	false
Preview:	......Q.....f.../)...J..m..B?"5....z..QS..(5.a........M....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{27540e99-869f-40e3-8c2e-.DS+...\.....-.i.avW.....{...A(zp...%..U].~l.)........W...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/. ,=..%q....y.3.1j._....0..E;z7..R.........'9.w.........K....itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProfessionalR_Grace"]</r...J..-E.....f...17V.....b...^byx....b\..!...y~.t.......G.....yPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2.BQ=..GE.....h.3.1Jwj....o...dRx....1.......,?.K.............YlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZS.;U&..*O.....l.\.>^af.9.M...vke8....8^.

C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10979
Entropy (8bit):	7.170242357409547
Encrypted:	false
SSDEEP:	192:7ELeQ/2srvbV0uKa9eNgH4u7wQuzWxNDIuNdNiRTS2wkm:n+GnaRVbuzO2Fwkm
MD5:	5AFA243EE67CC7C7DF5F997669A0329D
SHA1:	71D35A66165054E17023CFD8A956D0197F2A80CB
SHA-256:	3556D375464B441E3CA3CDED1F10078DB8010EF1A0BE062EA35C717D4622CE5D
SHA-512:	FF0209E055EA65AFFD0653A32FE84B854D61EC9E2A7002E69AE52EF7440674680E29B31C564AAD5C8C7807CF0C3B2081027359C146EC3C10D644AD8DD46E029E
Malicious:	false
Preview:	cz./T.B....;..]..W.`Y......(....0...C.u..p....6..4z..j...I..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4fc61f6f-812c-459d-aa0b-...p.GM....(...K....j.X.....{.9N.......{.2...B~............J..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.d<3.b..F..........$.T..U..'.N.t.Q...&y.j....?:..?N....?...D../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ..[]..J...'..T..Z."AF..*....;.. .9.../b.>....<...X...?...J..s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b..B.!...\...}..!.g.A.. ..+.'y.7...C..Q.;....D+..6w....8...j..PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4.k#.8I..\....Q.1.c!...=..5.\|X...%...e

C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28883
Entropy (8bit):	6.7379380743546955
Encrypted:	false
SSDEEP:	384:XF1GlJD0CUp8bhDLc84tJvizkSr1wgGkg1LZdLLveeeDYQkUgwae/sH6thWOpLWt:V6l0wh/+2r1GRVZdvZfwbDeeJoccOnY
MD5:	BF53DD8248205E61844766E0CC0AC1AF
SHA1:	03CC3728CF033ED070FC8ABFC2DD5FE9AC4CB75F
SHA-256:	2BF597EDD165134CED99BA5C568D801C5A19D3F5969E1947ED31227671DAF8A6
SHA-512:	EA3CC8265C1B1523DACDEBEF2C48AF01203700A2FB3328CAA4D23B48C1AE4C97E2C94845C2AD8276B164337B10169B44F7A2CDE137E1CD60B23FC0594E036E29
Malicious:	false
Preview:	.].~..F.M>;.L....]?..A...fr.u.....B....O.t..`.......=..l..2:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{9c45b7f8-5786-2b6d-9d30-9819897d03f4}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xC..1.....N)'\H.@...j.....2(O".'...8..k.U.p..}....M...wO.a..+.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office54FF28C4-56AD-4168-AB75-7207F.......tk.i*L.I..O ..P..g%I`.......\......T..2.......\|E.(..915-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X\..p...R.ywZ@.S...F..\..q&Wz..........U...r..h......JZ.<.$n/TM/v2" value="Office16ProfessionalR_OEM_Perp"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:...5...CGI4:.C..D..\K....N)ZA.........H...o..w....S..=..'..5ty><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD..........n}$......Q1......rt.{..<.....

C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11936
Entropy (8bit):	7.079464432256345
Encrypted:	false
SSDEEP:	192:D17P6xyazvlW5jPNZh30sayjccwhxdf5lQIAA0D1oq:VP6M+t+PTh3DYWIAA4iq
MD5:	8F5FF4C9E51AB96B3517D7277FDBC4E4
SHA1:	3C2D68028A1EDE4AD435C50D6C65428C00358A47
SHA-256:	F98E24921ED1D3E69B1A9CEB3985BBEFED0B909D385BDE3FA5ECD36B4BA5D7D1
SHA-512:	240F2F1E2FE6909083A5FA8A101F527ED643C128FA3D0EBD1FAC3BFE22E5E7FD41D6E434319DEF6D204D4B100497A9D869C1EEFA4F6A5FB929BA0B466612DAA6
Malicious:	false
Preview:	..\....$D.(......L.j." ...p.u.F....#.Xz.U..9.....[]..$..R.Rrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{44bbf4fb-3d3b-4f8d-a093-+..Q.].pV./........7.sxBY.m.&.Q.....k..V~.....`....V1\|,..WN.F..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/Y...n...V......V.R.~.it..YP.z.B...M[...+...5....2LZ...gE.....itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProfessionalR_OEM_Perp"]!...W..%..5........z./rE..m.p.......\|...d.F..=....jlF...8..N..ertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.orz....X.x].5......M.z.RS>0.f.}.T.....j...7.K..'....UvAE.5..G..\YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrJ..\|.\.qO.?...9.,...FE294'._.q....BX...

C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.202705091144199
Encrypted:	false
SSDEEP:	384:GKm67Q5Vyy3sWIRJM6lmi/K9BMdGuXy8wa1poG:GmkGyoRJm9OdGui8np5
MD5:	C1F8CCC7C34027AD5C8DC85783DC2844
SHA1:	1EDDEF4BDB16074660A4C544362434CD03CE543A
SHA-256:	1B74C67F84D1ED4CEF34DF18886AF46B5C531EF79B1522C42A901958DADDD9B6
SHA-512:	DB1C7C7B8DFA23E64F9E9B6E7437972816BB5AE37496F521B129090A419A1FF820F5429C89B4FC6DC3D9ADDF7D9E180C97D1BF7E880FADBA313860FC254F769C
Malicious:	false
Preview:	4.p.C..>....-....A.....W.F.}..[-.62.K.z<..W%1....d...1G.......Trg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{5c448bb0-45d5-4df0-8357-....I..f..[#....A..\...P.w.Lu.y+..u.t8...,g..R.a...........s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/....$....$q..._].AF.^......_u.rpF3^.5jG.U?.....d.l..G....J..:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProfessionalR_OEM_Perp.p....<..,&.....F.[......v..P\|..4\.}..nD.F~/....*.-..[.....L..opertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.._..N.Wb..F&.....H....`.d.\|..]\|.&xZ+}.0n]..s.........4\.....?.Xz4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlEx._../..f..+,....L.x\|.t.h.J..R.$.U.=.\|

C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10971
Entropy (8bit):	7.090775121640444
Encrypted:	false
SSDEEP:	192:ovhyhDSNNQpVVwADv3CnmJkRI56titOhp2Ma6u:4hySNNIVwAD/2mSRI5kOO6D
MD5:	02B2C1C66AC4B73D6CD5E6B1A807DD8D
SHA1:	9B8E310FF274E28FDD12ABF48ABB6EE955BBFC0E
SHA-256:	9D970992E9AB7242E3C8158640FE35D33DE269385B133A597CE10B95EB0AC06E
SHA-512:	F20B66A7A685811AE93CAFF3BB22243C05FFB1C4A9903F26225FB0BA0E0FD701D34C989974151A2FA046173418701A1F778762A0306F4999C93F63091BD9B336
Malicious:	false
Preview:	:.Oa..../-..Gd.P;z..._....]Se.......}l/q.f.vx.(......'z#H0..}.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d21123f6-07a2-441e-9dce-.Q.8.3.=>..I/.Fk4.J......W.f.....mb+..1. !.`.#....DP.}..b.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.0.r.$.=t..{..8d........._\b......=?x>.h.}1.$......zZvR1..'./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .....;..-9..Pd.Y$f.........U.7.....;6cs.s.s..".Z....3fvU}..b.s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b.)......?n..dy.p)..u.......\|PE.....t.P..O.-Z.5......b2q...:..PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4...m....Yn.V=.\Q.....G.....NJ........l\|

C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28881
Entropy (8bit):	6.76311842186053
Encrypted:	false
SSDEEP:	384:0QfQJtk8FUZ4EwtD4RfCD4drNuSGt3LhrXRz+xZ4DZQwIT/H2TE+ee3RX430Tn8d:0B+eDiWt3pXsxaKFiTEp0TyCBWMgcS
MD5:	972A7D5C2B006F60B3459513C2905D8F
SHA1:	C3A16903AFA2C5D1F1ED3993F34E050FDD03B010
SHA-256:	FC051FE02359435B7FC19846F8E532E8454603EF4FA8B94F03D596D7D910C935
SHA-512:	22EAE653F8C3CF6682779589D3676469E3F0032A22B7567B6173A261B0E17A48E8BC29DE69E420FE397EF62BF4CE286218DE66938DE8282A34BC3640A324C840
Malicious:	false
Preview:	.../Ac.....e..{............W...-K..._../.h........Y.}.y{...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{ff8d51fb-f86b-8fc9-a7a6-8a86491b0859}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x7.4`Dv.....y....!....@.........[...K.../..5.l...N...C.7Rkv....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeD64EDC00-7453-4301-8428-19734i0.U<...7...(...U.......P\.%...Z.y.e.H..J.....S.<X"?..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X(;.!QO....)....2....C........O..dI..^O..v.n.........s..G.+.../TM/v2" value="Office16ProfessionalR_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://-.-=.r.....q....+.............w...Y..g.u..DD.....5.++...><sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-.7.%S*...!................#U..w...Y

C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11928
Entropy (8bit):	7.066677330101964
Encrypted:	false
SSDEEP:	192:3NM+lVYTywP27rudcqhEgSAJjYMJl/Ds/47jgJzbCfr:3NM6hwPa/sNJcSfgJzWr
MD5:	69950F8D0FC0F206CE3292866CD89B84
SHA1:	FDBB47F762AF54707BF387C4EE266ADC4B973F58
SHA-256:	38E0C2B97AFC48DE6D79DFCA2DB0A6684FC0F13F859FFF513D68A99ED49A1363
SHA-512:	10782347C4E21033274132774FC14938D3827FA8EEF2537D81C365264D3CD9329BCF7DAF752D3844E30DCA491AAA046DE87450415D698AE70C2CF8C193D3876E
Malicious:	false
Preview:	.4C6..r....1....\|..d.Ro.6.....+.2.2.....O.......6jd.P.jE..hJ.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{ba626475-50af-4164-84ff-h..=.-P...z.F..,S.9..7.z.....<.w.+.]...AQG..[...C..gZT6...kU.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/O.%..R/....D..S...p..;.=T7.../.0.pCm.....A;.....e's.].s...Xt..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProfessionalR_Retail"]</y..d..s&.&..../..e.J).*+..._>.v.4"T...../...V...5fG..Kh_..v\.tyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/9..:.&L.'...Rc....1..!<....r.].".T...2.A...../a..qF{,...2`.cYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZX..>.4!..$$).3.l...=..`2;.....j..ZA..

C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20272
Entropy (8bit):	7.154228128641751
Encrypted:	false
SSDEEP:	384:m+k4TAsoIh9ypR8q2T86ulIu4HW8uHQAUNWLkknK:MwAsoi9yAFAftHLUGK
MD5:	CF24D492218D959AF2BB7E36376D735B
SHA1:	E96061B617BF810A5ADAFD58F6393E41E80BED10
SHA-256:	58032FAF71D5A3572521DCE91BBA3AEF06E5437F36906D3C1F059CA30EF0A865
SHA-512:	F459FE73FB1A71C8338B01B81DC3D93FE128CED6C09B73158357412090CA2B1F56A6BB5490BAAC956A9069E5699E8BCEE29F403C0A19D548954C9BCF3AF72BD1
Malicious:	false
Preview:	p.D;\|......zQ..c.<L...((..q...XG.5u.....^Ia..Bd.}w'.4..{..i..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{024883ab-a7b9-4d23-9fbf-..3'.......1...-.aF...Y>5.r.M..^.}.....@7.C.X-T...l.h!..j.^s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..(......7De...}.(.....u...v.M....M...F..\SA..Bd.}.}.4.Wj.O;.B:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProfessionalR_Retail"]...="......vM....,@...$5..s....U.j.S....K=l...(.h@<.c..q..u.@ertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.or...7s_......wM..b.,@...0.>..s.M..~.\|8S.]..x.;.Oi?WZ;.3..b..1..YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr..H.[....H:tq....AO...9....].O..I.NtF.

C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11483
Entropy (8bit):	6.980413617326616
Encrypted:	false
SSDEEP:	192:iCu1RowV9TkvOj0Ldumx3VmyJqzUg9MEtwCuhxhJ:q16o9TGAaFxlvqx9MOjmJ
MD5:	753462699507C10BF98C300E1D53FABA
SHA1:	200D9EA466152E54E1AA1B661058FDDA67E971FC
SHA-256:	4FB48C6D76A70F86326C5BBFB8A0E5B8684D2F605A3C10A0FD2F81582BFB9393
SHA-512:	56D25839E43570DA19ED597F8C03BF8DFE35910A7A4A608ACA9B69CBBBB9479F822C8295AECE470B42F069B43FF53FDF8203088BCC8D1E66BA4E78DFBB49F577
Malicious:	false
Preview:	.e.k./3...JT^~.T#b.(..@>o.?.37uV...H..z.6.r.Y.N.L}..k4...bT.M.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{2b19b0be-ded3-4102-8794-...4.en..BMEP5DBs,.u._.f#.".`4b..a3..].t.t.{.....zT..\l.../@.R^s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/t.8xo%...U{k.aV. \|.<.E.7d...<0q..jh.5O.)..,.&...B.Zv..$i..cQ.../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll F...V:;..FHI~.]<~.)...4s.<.de`Q.4,..V.3....%..._.R}..w$..`Y.W^gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200..En./3...FA.5Z.L..M.U6:m.5.f.}..7+.[O....w.;.i...tl..c-..CO.\|ArlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvVC..$O ...HkKkmU]&k.L....f...+2K..q..t.)

C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	28985
Entropy (8bit):	6.7374577285926165
Encrypted:	false
SSDEEP:	384:6lQAtjJMlCUMooef6/BvZCVmGGtY16cfBLNKoc9KQPcM9UukD4l7VzBuUc8f2//k:sdjJY+qV+Y9HfA90+mUcdjuWud7f1
MD5:	FFD32DEF010CF2ADDCD9F25C0FCA44E2
SHA1:	9EB0429F66B394ACDEEC70182849C51BDC7D52B9
SHA-256:	F43EA7ACBD44C3B285631FD64471A502630D4FA92C9884A0AE8E041F79115EC4
SHA-512:	3A7859D6CC94C856CC74AB1B95B7B47818E79C84E13DF022DA9B9260DC251C71908CF56F0DC0891584A2C52B2D965FDD09F9B8924898070F8062A5FF60D55F9C
Malicious:	false
Preview:	FDO...2....].ph..DX.....b........8..)...H..&.Aj<T.n.......7.O:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{1962f9c1-1af1-f4ac-fa0e-575033f936a7}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.....'......oc.........=.QzI......jS......).\#*..!......5.V.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office39A1BE8C-9E7F-4A75-81F4-21CFA........."Hb.\|c..VG....a.\\|.....0..7^..[..!D.j5N.v......s.D15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.........DV..{o...!....c._b....q.P\|Z.S..6.Imw..n......../TM/v2" value="Office16ProfessionalR_Trial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://w....-......pk...'G....."..o.....-..{_..H..{H.)e[.o...6..<sl:policyInt name="office-E34AA7C4-8845-4BD7-BAC6-26554B60823B">1</sl:policyInt><sl:policyInt name="office-E34AA7C4-8845-4BD7-B....j..PX..,D..VG....a..90....-..{B

C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	11940
Entropy (8bit):	7.017306472098635
Encrypted:	false
SSDEEP:	192:26oV+eP+sXTUXDsSU/dqpgAhsFsGlts4DYWfRJmuesaex:0V+O+4iIeDhUbYaJmL0x
MD5:	958C58AABEF9479033B27AF7C13032FF
SHA1:	235B2DEB97D6106703F4827EF41027B9D592BE9D
SHA-256:	9356D7FE4E0B9E4320BF3A54FA064302853313B7DA35C658268F501769E82FA9
SHA-512:	B8374EC6D48DC49884D54945C8CC7BC39DB6839EFBD529655BAC5E6075D7E830BFE5657A5781DA0B37A0367D0145E06B7137966E529A3678C51B17EA36B84535
Malicious:	false
Preview:	......](C.uK..Z'w.H......{..X.&1Qg:%..=f.f...%>..X.4b..Yz.zrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{1f0f9807-958e-4287-a5fe-@J....U"..s]...1'..H....m....~t.~,mZ.3b..1..s......o.....My..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/3}m...}.Q.DtG..kt...P....&..W.~3.%\|]q.m7..M..&..vs..U.-!...f.4itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProfessionalR_Trial"]</rMNN...u<..uJ..Z't.VI...t.....}\|VR0d..c..l..a..??...~2..Eq.4yPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2G......<..tJ...kt.+he...y..T..V\|@f0}N.n...v.. ...8j.....;...M.#YlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZS8f....r6Q.wv%.w...?~i..[..V..a<r*%lG.U

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25919
Entropy (8bit):	6.6151414703732865
Encrypted:	false
SSDEEP:	384:SS56+aW2aa0qbwEh6Up/GQNuTteIOfgPck8uzoo+MVFJaiFNmBbvwfmzUNfK/Lo1:Da7pzp/GoweOWrvZo/
MD5:	32F54D34CA2FA330D083F3DFFF1EA5B3
SHA1:	D34BB48FFE2E5DAFB7A8EE1DDC14ACA8D404A653
SHA-256:	816DD530BEA910A3C3BB676F6176820F95A82EB545C8FA7FF84BD70396AF1E9F
SHA-512:	7A4F4A038C36C34B8C68F2D424D74945CBDFB25506B03655C1CFA74812D7F249516F80098ADD7DC412854CA4989046A84344BBB2EA400D670EFC4FA3B98D56F2
Malicious:	false
Preview:	x.i(M.p3.J'{..........M..q......?.Wb.5...v}N'.F.4W...\|.uw0Hi...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e5acfb8d-542b-997f-cbf8-e6af0897d0a4}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.'d&-X.!1.];2......^......B]U...}b.O.b&gZ#.M.}A...x.r=xZd....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office220842AE-9681-41F2-AF5A-4DBDE.zL.TvE<C.kuD..........\..r.PS...8._;.+...e7R....4^...y.86r.-.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..Fg8a93e..k4.......r..P..p.SM...:..`.`..\m$P!.L.3....?.T.m-9.../TM/v2" value="Office19ProjectPro2019DemoR_BypassTrial180"></editionId></tm:application><r:allConditions><sl:productPolicies xml.80&{.Vtg._o'O.....X.T[..j\..........Z...W..8...{A...b.i?+.2...0</sl:priority><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6ED.zNx#tE)>.im0M.>....z.....)J+[...{..<.-.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11996
Entropy (8bit):	7.049482113632088
Encrypted:	false
SSDEEP:	192:iP6CqfNGQPugYNsc9ROGk1VSoDe1jt13bdbXLNH3NGXQ:iCzfT8NscOfPDe151rFXxr
MD5:	3C5B69394E5006A8244B17FE226FB566
SHA1:	89A17B02D8AEBCB48309EDD6FCA81509233E58AE
SHA-256:	6BB6EA2DA908C9B22ECEEEF09DD4CF63AB5325343944A2CAED9485E245A69A34
SHA-512:	FCB6820744544A666DB748A5F3B83C0A19B0D5F93DE4756D1E5AD3300C86B5F1576750A0356E5B12898F4277F7F8646E130F0816BD61CAEBD4454490975F6FE5
Malicious:	false
Preview:	..'l?..5...\%j.{9.C...I'.....Ze........\|....;R.R3aVx.Z..\..^.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{ef76c77b-8907-478c-a31b-('.g4.IjK...+!.mi......k.....M=.K.....x......i..d..wOPd.....A.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/X...X.4....cyu.7:......@,.....^=.@.Z...K-......6D..~vQu.C.......itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19ProjectPro2019DemoR_Bypao1."i..h...sj,./e.*...\;.....Sf.^.@...e......7E.M:.Rv.d.T..L.pid"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http&m.'w.W....\1,.%4.]....A%......f.#.;...r#.....7S.M#U.{<C..i..z.jn1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZnr..s.+5j..\.Y.ZM.F......./..p..7.7..\|

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10995
Entropy (8bit):	7.181960851007879
Encrypted:	false
SSDEEP:	192:JddovauYXlRfz249f4z4tUlpIgo/D/1VZ:KzkjS2Ftgm
MD5:	96A76BB997738B419D13A46970B6B532
SHA1:	72B03F0002840948FDE18CDA99E160154047B7A6
SHA-256:	61ACF38C1B55C93FB99A844E0C898E1AEFEF93E650791D9E86344533B0FF904E
SHA-512:	42657054E1700ED1AC4C11580D4AB2424CCC53D860636C030FD8900A15FD7AF8119DEE063AE52B42D5D13523ECDFC078CA2195CF08B00F23F541611EB5BB9265
Malicious:	false
Preview:	6.t.Aw..D.?=..AO......W.A)...F.],...5......,Z...<.......D.c....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{6ae13913-0eb0-4fc3-97ef-...Lm....hz...Y.XF....Z.?..IE..i...}...*.{S......3..<.7......s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.&..&}..V...F.....Z.O...Jt...A....X.H..y..".....1....D...b..V./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .....b..F.3!..@F....I...]...M..Ze...w..b.9Z...l.4..2.........s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b.?...\.T.j.9.^o.zo.....{....f.2@...U...Q..................T....PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4.....E..2.5...tC.B....O.~...i..=.P.h...

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26000
Entropy (8bit):	6.6458369161095625
Encrypted:	false
SSDEEP:	384:DPHBy4osd64ywPhEzJ+mZgKDnVyxX4ee1XWRosIfJJhJWuQuPY7V74XEFX7aq+uP:A4/3uF++xMxwVf1eqyX7lwlto
MD5:	F363D743A08EC66EF7267C08AC292F34
SHA1:	D9362DF17AA8B00403CB5EE63107C6D4202D48C9
SHA-256:	BC1739FF2F4411248D5A6D2F3D6E58EC545186E56CD5336669E7E77BCFD054B5
SHA-512:	761740E91DFB6AF6ED2EF7D7CD8C05B005C59CA9111C2DE9E87C3B93BED1AD55D175D4A67BB725E3C96B9844E2BB1DBE0A56D600A8067AB70D63E6217163BAA2
Malicious:	false
Preview:	.) ..bJ..tA.%.......Y../..........WD..K.7 9.J...lb.`L.a..t..N..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f57aeafe-d294-d657-cf4b-47909f1535c2}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x$...w_..wV.l........{^.^.AX.2.}D[.Y}Xp#.N...%t.%..{.C<..L...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office499E61C7-900A-4882-B003-E8E10....#...R`.........F.>.....G....._.(.._13s.j..lk..T.k.H6M....15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X;....Nj..0..j..... .2.....Y......Fa...f;`.L...k).wL.K.~)s.v../TM/v2" value="Office19ProjectPro2019MSDNR_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="h=....5P..,I.5..........e .#...%..O.}F`.V.7!o.S...mn.a..?..)X....iority><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4A15d....7..2....[....,..hZ.R...R....R._..

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11951
Entropy (8bit):	7.074179780623961
Encrypted:	false
SSDEEP:	192:lMjQGdtzsd12G806aufTQpQry2ifXfvqrpX60cyolfuK:lMjQGdFs+h06LTZFiXvqFX6yo1J
MD5:	EBF7E8BB1F250A983EB0577DB0C3D808
SHA1:	3D092EB3FCEB73BC898BE718BB8F173CA025713D
SHA-256:	E72B2D4CE75C93A4520D75AE6BA63AF00D7D7F07348E47C4B50A04CD302D4291
SHA-512:	BAFB739ED60A44749E1AA26EC76AF4CD2F6E412AA2274FE109760248399A1B843C7C6A978E7DC377507F8B8F6E53BD0F366032EBA26ADE71E306A974CB40282F
Malicious:	false
Preview:	.m.....{...~9.W........YB..H.._.....>.n.c.9...[0r@....n./.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d511b34e-fa65-480a-b087-X.,.F...c.F.pr.A..".....DHE._.....q..:..9.5.k..."1.E.....z.0.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/%...}..i.&."&.....kC.....y@..L..^..Z..o..E.l.4..FL7.Y....-.f.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19ProjectPro2019MSDNR_Reta..mn....:..a..I..."^....D...]..FY..,..r..e.y.(....!`\|E....<...propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.wR. AB...k.].4..T...8P....eg4.V..F.....d..\|.1.....6t!Jz....L.=.y6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRl$..Ar...F.&.......T.....sk=....h7.%..

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20295
Entropy (8bit):	7.179110149282385
Encrypted:	false
SSDEEP:	384:HW7FoRT6Aqnpoya06Le3pW8G9mVbTnctLUySp8cqTPvRlPVmDh:xGfnCya0aeMActgyE4wN
MD5:	A6098D7D876D83EC881CC639E7143734
SHA1:	8E1AED261041377D72A87199DA911F84A4FD5152
SHA-256:	75DFF21A522FD074A53389A9F6CF5CECAAA7C4DE87AB088EA7CA44F1EAB381CA
SHA-512:	96253FC28E0DFAEBFECF2A738488391587F643160339C65AE60D7E243F9656243988F76BDC3A6A1A96F4090EFE0F83968C9A1F966D36A47AD7728745429DCF21
Malicious:	false
Preview:	..!..&j3.`E<.....1....&N-...\|...8.^8f....i..e"..`D..P.......t.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{0206c977-89d1-45f6-8152-.....;1f./C/.MD......~.a.../...}.G......+..3{..\r7gq....C.k.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/x...,J..9t...V../.D.rG&H..s...:..~......u..E"..`D.j........(.:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19ProjectPro2019MSDNR_ReH.....;pG,A ....c..C.oD-H..g..h.F2u.....i.Hek..\|y.'G......9.r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www...,`p.&.~._]..~..C.a.aH..F...c.K2>.....H\|8..O^M=z.......I.aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQn...,P.fYiz.VO.!....ei.%..P...".i.....

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25928
Entropy (8bit):	6.638996623152571
Encrypted:	false
SSDEEP:	384:FDyT9BWUetxdrPRNWCUI8iQPcn/INZ6YdiOBELU+/X/V8VRcRoA81xrVvK:GQJRPfH/8N6RjL1oAIr1K
MD5:	C8A86C621680DE23D1C92ACE2BFE2204
SHA1:	6E817C57D004FFC931B689A7D24330A06276750A
SHA-256:	55EAF1ACA3004E15F5BFEFE38EBABDEB1DD5F8CF4AA19B5E68DA03242F4DCCD4
SHA-512:	53F7DCA5CE5751491B25373E37123AB9618FE36B1CC16E5F4F50C2B396761DE0999D9860C8AE34F2618493BC562CF9AA48AC2F4C1EE5E2C4E9C8072D94B6BAD6
Malicious:	false
Preview:	1..1.....A\|...r...kQ.R..2mq..?N.C........a. h..@..Y.......yDe.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{89bdd3dd-b94f-3cbc-c6dd-fdbc6d16fbb5}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.q.~...O.Bk...m.E.7...@..c2%.VhB.d...}.....{k$g....X....M].tF`..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office7D351D13-E2F4-49EA-A63C-63A85.,<8..JR.g]D..~.L.?C..H..%np.P*I.D........+c.o..@..F...CFWA=.t.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.P4?..7]..;Z.y.V.5...R..=lf.N0..F..G....8a&x..G.WN.../pH.)\|[./TM/v2" value="Office19ProjectPro2019R_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:/.j.z.....Xj...3.M.u;..]...N'.?.\....C.....4a .........GM.N4C~.y><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4A15-4F88.%:?..K3..+\..%...xA.]..krz..;..X..C..

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11950
Entropy (8bit):	7.085003270265862
Encrypted:	false
SSDEEP:	192:h6hcp7q6JkL0dXuepzw265V33iqY9vam05bHRd:h6yhq/L09kv3yqE05L
MD5:	A190E85F747F1D5842665F7D7A53CF8E
SHA1:	80F6A7D9C20671BE3DF833610F7D275D99F334BE
SHA-256:	B0E625B1DEF9EF0865CBF3235E5B40EC4923B9AE31E5BE390C27A0D3F7D463CC
SHA-512:	F7374C6234D433FD8B94C59C91405F8061B89D2A8B19F30095A9BC42FCB99CCF2BEAECCA989084FFD868BECFD2D52C609A50CA64EBDD6EBE6A3F7467C8DC4B00
Malicious:	false
Preview:	c~.U]..3{'.2....T;V......g..&..y.N....f+..K.iu...Tt4.'[...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{95bab19c-16df-47be-9d26-.![[...&;{.<.....d........4..~N..o......1"JC..._\...JG.jO...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.UF:..!"..n....JxB.......h..~...?.:..U..Mx..F.:8...Mmw.v..M.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19ProjectPro2019R_Grace"]<.."....Vu2.$.....4D.....b..i...m....L..Op.....j`....8f.:E...rtyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org..(YR...<u/.%....T4D......b..%..{.......h'.+@.Uz.o5u.3..C.BcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrW.W V...Q.p.&....;YK.......L..A...I....

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10987
Entropy (8bit):	7.145072217371559
Encrypted:	false
SSDEEP:	192:Z6rqMTi1z14CnEHqYPWO45r3ATltuNwU9Wj18lv:pMQJ4JtwrCuWUS8
MD5:	1B3A1336B94A28D4E7F46D3F96535261
SHA1:	5F1E263825A16369C623E473970048F077B9C0F2
SHA-256:	F44BEFEDD84BD8A3D69CE8128034828582ABAA61B81E24C9BEE9247DEF2DB801
SHA-512:	1ABBC809BD8CACFA196165DC8D34197B2F569042BE2D033D9614F2F6441EAB04B722FFD6B2D4186FC59E2F343E7AC2A89696479798820E33D7F1C10BEBB2DA00
Malicious:	false
Preview:	^N..F_..~..`........v....@YWS[....S..(L.&...E.eG..8f`.6.Y..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{7efb86d5-b250-4cf5-b518-.h.......y.../...T..O.......CN.....W.C..&../....y.L-.`X..{.Z..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/......f...O.=J..H.U......G].Q..Ub...OgV.r....H.ns..eF5.7.T../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .#...N...r...a.......\|....LP.K.=]...T*..&.....Ke..,z5.{.Z..s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b.e....[..+...&.}..^.g...`P8?\....Z.g@..y....h.gJ.}.2...z..PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4......MW.t...U...m..f.c....o..Bd.!B.B.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25933
Entropy (8bit):	6.674873233437339
Encrypted:	false
SSDEEP:	384:3ue24nVH0kvotwBS5vLTCN4/TDELClPcc5OJPaMW/5l59ibCL+WP+n6PEQlTv:EY0hFLTS42Cdua5D591TZrT
MD5:	4FEB4A6A53D7505BECDBBB33AE73E3B2
SHA1:	1D3BEECFD1C220BC13927975A52F40F4280A0BF9
SHA-256:	061F6FABD569B961BB51CE09A528F5C8B4B316E917B12E56939E148CD29D193E
SHA-512:	4182EDD8E4B7BC96BCF226D15143EC10518A56DEFABD494E36DC2A400F7E50854215F09A0898D07263D1F9898B24C1A446916405B931F1823BBD3DA60D79770A
Malicious:	false
Preview:	....6.......EzDnx..%.Kk.[._.c.nQP..E._.>a...sJ..<...>......8.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{81d5658f-d8a6-50db-f0b7-778d29191669}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xv...3........AeO4`..p.Y?.....7.b^w..E.%.N......xW..p...$..@...=..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeBC39E263-86FB-4822-AD08-CB05F,...1_...-C.EvO=).:.Qz.L.^.1.i.W....APlg.....(...&...4..J..).15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/Xi...&>....K].IqC'3..\.Kv.T.H./.'.U..G..T.0.....yB.....M...U..../TM/v2" value="Office19ProjectPro2019R_OEM_Perp"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="httk...~......._zL't..x./\...I.A.\| i..Z.C.s1...dM.."..Rl.....#.rity><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4A15-4]...1(...(U..-.db.P.U?...W.}.?.F....C.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11943
Entropy (8bit):	7.100488296395675
Encrypted:	false
SSDEEP:	192:1G1co72sn+jlR7Y1DZQGg02KMxiGP4QMarLhykAGfK7S01T:1GCI28CT7YPQZTjP4709K7jZ
MD5:	66F872AFD5796815A098AD008935C395
SHA1:	C54D1747BDA2140780374D6B7DD5F37E60A15663
SHA-256:	67FA9F347FF929D34FFEA119E0551D890BBBB6F996816B474D5DEF4E99D758F6
SHA-512:	7D4DE0C3EA1B9DFAFBC7D366EBA5E69C873870F5D209E63521A7F24CFF8A53617ED4924F33BFB8779C23C696DFCD42F89D430F899B248B735D0B3349F76FCC21
Malicious:	false
Preview:	\2.F.........:.K<...H....NG...~.5.u..w.JQ..R.>..4=.o;..?.up.Drg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{53d5fc04-569e-4643-b232-..H.M..M...S..u..r.F......SM....;.,.=..y.D....l....W.Xc1.e.as..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..<.!."3.6N.gLH"......DnE....\|.x....'.....].3...y.b"..n.6l..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19ProjectPro2019R_OEM_Perp..M........"..'..m.Z.T...@GL....b.3.>........L.<.s..p'..y.k$..opertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.....K._O.[H..9..w...T...;jF....)......=..P....k..2-.j N...xW.Hz4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlEx..&.*.&K..I%....9S.w.9...7cp........"..q

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	20287
Entropy (8bit):	7.246716216580021
Encrypted:	false
SSDEEP:	384:8k6jq/k8PlpKytOj0hni66R5h86aT3ABVgB5:86Plwy0jekRY6C3N
MD5:	58520ED9C89D25AE866039CD2FEC5372
SHA1:	62D0C0F5AA79D1634B3DC9EADDDD9AE07B141822
SHA-256:	F445A7FC1F9C445A950E33BA64EDA284C6E8B8212092FF5FA45E6B3905B3CED0
SHA-512:	16305410765210AB36E26E7FADA75B9A7F53CA4C52827A20634BBA1926EDAB2EDC2DBD132FD5E15C6AD6E210E280E6288ADA33BBB08A64290EBBF02A7A80B5F7
Malicious:	false
Preview:	..3.=.!....=...]B..;U..h!\|O.l.=...........&A.v.>.......(rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{60e01879-4900-44b5-abb1-.....w.}.d....r...H..c...br.X.).$.......J...t..@.T..Z......\|s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/3o...7...s.[.`...I...2^Sj.{K.n.p....W.......&A.v.Y........H`:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19ProjectPro2019R_OEM_Pe.M...j.w.2..........`.B.6.}Z.".w...H.......7j.h.D..........(propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.wD...j.}.l..M.........`.?6M.wQ./.<...H....S..M.r...8.....[y6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRl2E......h.._. ....>.....+ A.A........

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	7540
Entropy (8bit):	7.137550525616643
Encrypted:	false
SSDEEP:	96:/Wmm3HI/QsuUH3DE0t5SZ5iQI1PpuDPDl5x4ODdiGRn/yTOo92Lw8lAaoCZChxd:ero/hAjZ3MxUrl5xphTWOo9dKZCR
MD5:	9466D67F1A103692E8AAEAF8E5EE0BFB
SHA1:	A8AD89B1C46332558C27ABA7D42B70F4B26AF566
SHA-256:	CC27C1F5FD51EB1E04298436B08093B9E669C90E52C9AA917959BF94BF657E94
SHA-512:	D72B64F233859792C32D906C01CBFFADFB23753B4820E61E5CE83A94DD853AA945F2366D3D0697C22C22C8145F6A59D38D71D69D195F800305B68A91C5671809
Malicious:	false
Preview:	.?No....b.Q.{...T0....g...w.f.7=I.....G......u..+i.z..G8...'I:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b559ffe5-dd9e-b80b-8623-c5bbd3e59586}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.. ...`.F.2...(...T3...#\j...c..n(......h.8g,B~...p..."P.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeA1BFBAE1-3092-4B33-BF77-0681B=..c......p.D....a.....`...%.aN0(A...LA.R....'.'1v.....z.W.6B15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..a..4...4...{.....d...;./]2s......A....}.eh~.9..0e.C.../TM/v2" value="Office19ProjectPro2019R_PrepidBypass"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl=Z.'V..5.C.e....a......d....64)d.{.....Y....[.i.$yx.o..Mz...9.priority><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4AI..g`..z...%...\ ....QL...6.7.2&C....

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11982
Entropy (8bit):	7.096531381616045
Encrypted:	false
SSDEEP:	192:/oE6t1MBQQy0qHEE97MC1xqGBOgJxyPzlJqa7/T1H+Cke06Vw:/oR1MEknCqGBp6LlgaDT1X0Qw
MD5:	7FEE3AAFA28695B6F80A91FB6C9FB9D7
SHA1:	268F74AF75683AA783FCBD5263F13BD8F5493C00
SHA-256:	6A9530F74D9195FB5A9F78598ECFD4FD86DD3D0860E91DD34C0DE4CDD30F8F5C
SHA-512:	DD84D09A3119263CF3F87014ECCA65BC13A19D0FFC16A413C968FEA7080A22308F3E92E412D949E38D4C1F101A6EAB9A899D0692EB20DE4CEE514238CB4EADAC
Malicious:	false
Preview:	~p.I/X...h"DH.Xm.2.........B5.,....^K...... ...A..Qg..;.,.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{53c23c93-0547-4126-9491-...G%C....v.F..{.\|...].....6=.i......PO.H.I..h..$.`..o.../.3.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..ZHR...1.{...!.,....Q..%.M2.............4...6.y@.F..H$..x.e.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19ProjectPro2019R_PrepidBy.<.2}..Y$&Xc.[F.`...L..V.Ya+.\|....Y[...9....$....V..@7..3.a.r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www..\|[.R....w....,.}...B...V.x...w......]8.......).0^.k..v...f...aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQ...ER..xQ.....A."...F...Y.n...6....qR

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10979
Entropy (8bit):	7.145376926291717
Encrypted:	false
SSDEEP:	192:Y2U1y4Z3rH5uKuB74MQ02JB5lrJfj294Ndm71Ig:YB1NrZuLhtOBn9fjH2j
MD5:	F8D413CE0DA240AD34B31F3D5F644DF2
SHA1:	534E083D28982DCFFFB22311847378D5C216EDB9
SHA-256:	4BB41B001CD5C3B4196716F392D4BBFFBA962A75BDAF825E69092AB7C5D16C3F
SHA-512:	9D39EC487196D9C52D8707A373F01CAF9A6743AB8F9EBC1B1F728AFAB433A42FA3002945C182746990E182A42B68DE6310828C3FE37EBF4AC84EC67FDA10E574
Malicious:	false
Preview:	\..^8.!L\...&}..15p>.{...m..y............S.[....X....2.@.T.Dzrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d084d5cd-5220-4ace-ab88-.c..a.}.L..(6..a{/c...A{....Q...i.N...]..R.D..d....j...I@.[.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..&M_..lNC..zb.2+3.0..0..v..Q..9.\......T..U....o..Z.Q..\|/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .:.,f.).^...1}...)}?.c..O.........Q.E..Q..[..........&..]I@.[.s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b.._3a.tHLY...`..#Y.\.;.7E..z..f...w....;....?..u....w..w3A-F.PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4.:)Rl.D*Y..7$..[a.?....2X..d.BG..M.Y..

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25931
Entropy (8bit):	6.671785731084681
Encrypted:	false
SSDEEP:	384:io2bME34N32uFyFDIuP1EYBNKQ+OotPcr/u5falemyenfsVKDKlx1Y0IdC5:5bro1FDBuYPpxoolsuf5e0O
MD5:	7C1400B291885388780DA87CE0799AEB
SHA1:	16D8F5ECC5117EB1463107A72A0A3981A161EA1D
SHA-256:	38AA74A1EA520E69F14EBDC71875252B70F2F826722EFFBB0CB27A650CFE23BB
SHA-512:	00A3CF025740A4D4A747179A9EF80A74577E171F6C0376B823C5AC86C6465D56F30C6E41B0AB8878A15A5FA6F2CDFBA7F84C2E6455D946D820E73DF9B8B3DB8A
Malicious:	false
Preview:	...\|...2....L{3~..V.A..$n.w......)'...".....@.k.........y.9m.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{aff009ea-4e95-3072-fc3c-eb3c9fcdc35c}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x,..3...c...OHd8$.P.....p?.#.K.......e.0.....D.`.....D.....k.;h..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office0D270EF7-5AAF-4370-A372-BC806.X@..~...R9Lw8-.XD....#y.v.M..M.</...n....`.0........"H}\|.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X3,:r...q...LI@p47.R.....'a.`.S..^.gn._.j.....F.a.....>....\.S./TM/v2" value="Office19ProjectPro2019R_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:nN.7...7.....C`s .PW.1...._.^...oc...q.....[.z....Z....6G#m.ty><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4A15-4F8yLN...o...@M.#e..xZ.R..9a.c....S.35...q

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11935
Entropy (8bit):	7.040322134169965
Encrypted:	false
SSDEEP:	192:L0Km6ihrxana8l0OzlklV17VAXU5dgZP2KxhKxc7qeyu+7a4g:/mJxAavJlrmXUDwxxYsqeFig
MD5:	24F2771BB89697341C7273EAED8B32BE
SHA1:	6E9CEC2D13D9A2A91F19E43775ECC8A00A805871
SHA-256:	4C9EB3F8596F388B7BE27D8D75808701B36A571271E79BCEDDD69CBE1E2804EE
SHA-512:	FED30854553446300955754EE4D23D6F36B234B18F9219524399C616E6E3F89E143037DDACC902698DA902518ECC2F37185857D81FB41ECEE0A28F157B758A5B
Malicious:	false
Preview:	@............V!..$...A..t.h6....vmF....f.(.CD..Ly.U.Y.\|.fC..6rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{46771521-e5b3-4ee9-815a-.cd..........7..{.....Fb.be....9tP.G..bqj.J.GBbpO.?.nPBe<...bs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.U.......3.S..m..g......).j9...2 ..l..7!z..K..<G.B.T.eU7....xitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19ProjectPro2019R_Retail"].(&...........J<..{....x.M3.F..9.O.a..x5;.7I..r.k.b.R_2.l...\|ertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.or.(f..........J&..7..2./r.Z>...?TO.U..+}6....+'A].x...B..g..8YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr.].........-.v...X...$.&D.T..(..0c....

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20279
Entropy (8bit):	7.213300978232563
Encrypted:	false
SSDEEP:	384:/MufVfQJCg6VysJ10u/93C20gML+/tAVn/J:3odUysJzM1XL+/IJ
MD5:	36001F15D2538374F28D09E189B32EF5
SHA1:	601055E21606312701ABFDC89CC55E4E3ECFF749
SHA-256:	5BAA326E8FADC0116115A97065731B27EF2C8EEBF2F2C5E8A7188459FC52DD2A
SHA-512:	6EA110A1FA60FFB86D38C4B37883E4CC0571F1E3404147938609806F50612AEC3138DBDEB6CDB7DD3AA47BC3E5CACAF77ADEDA24D0AFD5D4AADFF58CDF37C3F7
Malicious:	false
Preview:	R+2..C...f...sXN..eqnn.4..j..S....}...........4.....+\|L3... rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b7333bde-6f0a-4bde-927c-......]..$...<N.OX8{?6.x..`........5.....J..........]...~...ts:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.....I'..?.[...M.Dq5%:.?O.h.....IC...M.........4....90]=.HVh:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19ProjectPro2019R_Retail.......x}...nS.P_$/rr.(K.a.......Y6...I.Z.....z....?~.b.N.hopertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.......Z.. ....pR.JQhcrr..0.k.....N_....I......../.....j.zo.=.,z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlEx...f.t#..)....MQ<nU...}..<.]...,..P...

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11491
Entropy (8bit):	7.096659035914411
Encrypted:	false
SSDEEP:	192:xei21dIv1DrDeMTvGyWuKQLIFlG9bIuqI0NF:xerTOD1TvGyTIFgdIu/K
MD5:	854F6897C59454DB494ED55EC5B4F0C4
SHA1:	8AAAC5FEDB0C5759786F6D6E0AA8D4B03343B403
SHA-256:	B63B732580EF30E7905711413F347F3C6C62C0F2255E8AA95C12567AC1D5AB96
SHA-512:	694CDA797A4DA0084E875BDFBBBF30C7DC875259FDA8B90DDDE9A059BEDA03A98A6F34AF98106EC4845E583B1D8B800BC7477192A1025EB13BA51D733D8EB3A5
Malicious:	false
Preview:	&..'.E;m.+..".f\........,.....?a]..q..&.....'p.T.......a...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{580e922a-0828-47f0-9f75-.2q...2t./....4Z(.W...v...&K...UpxKA...u.Wq.....F+>.>..._.u..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.Y.4..e.......n.x.....'.P$......{,.t...&..(...f.`.F.....d.../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .j;U..Mjo.'..+.zQ....$./.$OA..T%gzH.....) ... n.Q.......l..gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200.$y".E;).'...pe.,o..*...vM0..G&`H....).T......H.{.......z..rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV.;9h..m"<.....+.o:n......"\|......:BE...

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25980
Entropy (8bit):	6.685352699267232
Encrypted:	false
SSDEEP:	384:hhgHjD4ME0CxeXSV47tCQXZpG0JeePWK8tXFu8BSPD+cldx5k6e:bMmdILJgF1Et8
MD5:	72905D3DB9FEDB7208863DFA06C4A582
SHA1:	E2C0F5F0AA284A5A5DD6951877DF11AE6DD99789
SHA-256:	90922BB20E8F7AD16720C1E874F7170850BBF95976144FFB2E5D2FB0D7212A98
SHA-512:	EA803C26DAB5635793FB6BD105A188839D7238587492E0D04DD13493C3FE155666BA2C7332379D491A3F52E74479458092ADE80983C20EFE7A041FF3F5A33314
Malicious:	false
Preview:	..........IZ.....i .a.$..A..n.Cq.l.G....=..,h.}..%.Ng.D:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{fda4d863-3014-8bb6-7932-d1603ca549da}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.gtS.....6]ME...JZ..=t..5.pW.N..n..Q..<.S....t._i'.g..m.Ce.].microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeF6C61FE0-58F0-49E0-9D79-12F51.;X......x+IV.......x'.`.v.....7...#...[....=..3p.w..gV.#.O15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.FV......f[EQ...Tv..t#.v.h.....l...a.w.Y....:.P;h.W..xh._?./TM/v2" value="Office19ProjectPro2019R_Trial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:/.\|mW......7.T.....~m..T<.7..+.......F?.w.Y...\|..h....%Y.`.^y><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4A15-4F88.3X.......`^.........."..j.#..*......F

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11947
Entropy (8bit):	7.069685898301271
Encrypted:	false
SSDEEP:	192:egXFuW1cbKmr2YZGVJtY3qJx8sAwEpSJcbE3:juwceyFZMg301cY3
MD5:	2377840773D973B06B06D5F00DEA679F
SHA1:	8B3C60E1E2A0D8502FD88484911D9BD2DF9B73B4
SHA-256:	27D9A391444F0EF803739BA36F3DE2F072990763F5DD782E17185BDEAF88F73E
SHA-512:	FB0A66AF90221A88B21ED5CF149C2E0EC2872FD62C0BEB57D12E7387924F6136404F4EBB4F3C46A247A402863854729C57148001A3CEDB67551E4D15BFC0B2BB
Malicious:	false
Preview:	\...V...d3!.!..]58..:.U...k.}..d...u..h.3......n.....*V..[pE...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{484c2af3-f0e9-4a42-a104-....Y.."&!./..Kev.@0......a.~..!...=_.f.=R...V.&..-w......=Q..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.5..1..vj..}..6&..~..\.E6i.z..f.E..t.8.mB....x..I..'O.O.!..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19ProjectPro2019R_Trial"]<.........=4.7..Zgt..%..V..8c.-.\|....T.w.n.....)...3.g..^.m[..rtyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org.U..Y..k=).6..T+8..X..{../n.f..z...-T.$.c#...>.h...4.7m.Mjd..BcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrW.4..]...7v.5..PJW..L..r.C!L.C..u.S.aA.-

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26212
Entropy (8bit):	6.670441970710912
Encrypted:	false
SSDEEP:	384:ad4V83wNb5w8waU6AmYavlNZlqg9Ey/2Ejee45wZDQs3Qjm6uhtDWe9ryX/OPjkq:PVxINY9l7eyjrAhJKsiSch
MD5:	6C99A131B03B90ECA23757ECD5077F1B
SHA1:	7F3E4175DB31E5E638B86E33B78056B3E9B5B6B2
SHA-256:	2C49FC59962C7B66CF873235B1E93415F198640DB9E7637699C613B998BAAC75
SHA-512:	AE29782C4F672A6D5CFA81015FD17272D1323E6946308F1A2F4E141A118A122C4D924FD831F72D3D535E9439B8DC0809A3D0E0481F0118C6D71580621FA4BBA1
Malicious:	false
Preview:	{z.(....G.y..s./..#(%...j.......s4j....V~...v.r#,..>..e.P..KqJ.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f9e01007-4790-9f48-90b7-55330b52f39e}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x...g...WE.n..w.$...vp...>.Y.....\|.[....D.c.b.}(1S.r.Wa.W..FsO..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office2CA2BF3F-949E-446A-82C7-E25A1...#...J7.XZ.s.$.Uw::...m.......63.....,...j.ux~..$..`......5[.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..&...E..>D...(.O}h\...i.......%1$....n]..h.b)$..}..&.q....It./TM/v2" value="Office19ProjectPro2019VL_KMS_Client_AE"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:s...\|...PH.k..4.(.T}uz...g.......3S....%oF.$.bx..w..`.Z..Y8..l:priority><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-...!...R_.$8..p..'4-..A.,....."-$.....

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11985
Entropy (8bit):	7.07055086820701
Encrypted:	false
SSDEEP:	192:aFr9xSLjZI9m/6bst4rQECzW4wDIFh4VcGof6uhXCy5H8:aFr9xuO0istkYWPInuhoCuhH5H8
MD5:	AE96564E70BB79B3E83E40494A6209EE
SHA1:	112FE280BA790DCC65EA0FF6BF1C8C122413379C
SHA-256:	42B4511782F632CFAC55F52877681AD820840327320208CD5D97A49619C78E01
SHA-512:	8290C46A1B5AF77385B7B8AA91EAC3069154276F1EA07B05F559E5BCA1A0BB6352A4AC05DB75FFEAFABB130D440C78F085AB69C92DBF9CA6F74469DE5D8C96FF
Malicious:	false
Preview:	}cw.W......HqX..tK..0...4..1.iuy.....H"ve..2...W.>#.."L'.....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{6891a29f-4cd1-47f7-9cac-....P...RX....$..H:..."..b.~-<.....F&x'..d....a.T....?}....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...0.....>w-G..wU..t....i..>.m-{......s(7..=.....)$.;.v.K...itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19ProjectPro2019VL_KMS_Cli....)".....c_..%,.Kr....8.Vd.\|r=.....Knpq.....E.70.oN>.....><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://w..[I...X.2...pF.Vl....t.Vd.]........"vZ.+....H..g.:.......N1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qR..-.....9uK...b+..Q......;k.K........

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9974
Entropy (8bit):	7.088285437023253
Encrypted:	false
SSDEEP:	192:a+745vxsCx5YB8gzPBxsPSHE9LpMsVtDCgbVej:a+s55sCIOgzPAa+MsVsMej
MD5:	22D8C41C43BA4CABC9D2877779A2A2BB
SHA1:	FE89CCCAA49FE835D558725D72336C2E3A03301A
SHA-256:	F9C6401A951F1251C1844D4FAE15349637BD7AD0832DA8C6A9DBE4ABE1CEBCD5
SHA-512:	69A5E16ADB228792E9E0406776BB9602451157985A67B394B2AA018011149EC249AC09118C6D2CC49E67C55CC512B549A45A9FBE3C773323B0E2B97CC722E04A
Malicious:	false
Preview:	.....e..}Vi..;.4sO..}...l}L......`-....,.)...U....JGX.hU...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{baf86d9d-ff30-4b15-8f92-E.1..\|&.>En...t..z,...%..qw...V.A.ve....".~...E..kp...2...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/b.D..o_.o.X...f..*0[.)..L.C..V.JM&U....\|.#..._......}..\|Q....r:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19ProjectPro2019VL_KMS_e.`.iM...Q...n..N/...-...ppJ.....N`o.~....<...D)..YZc..u...id"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http:..~.3e.sO~..d..9rX..0...j~.....(5Me.i..e.p...R....TiD..HP...n1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr..[.O~.%u~...."{J.o...Nzg....>9DS.g.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	10983
Entropy (8bit):	7.092584317268685
Encrypted:	false
SSDEEP:	192:ywKHISS4zx+thBeBz1gWf7RnFogYkmQHiHVs:LCy49+t7e5WWT/hmXi
MD5:	AD6253482E19C9C20AB05EB2FD0F0F02
SHA1:	B5E9D31387E17EA1CD1F8F3C4248AAA95A76FFD5
SHA-256:	94EB6EE6B565A5C8D1F9B40661939F1A8A6913537DD36C710AEDD93F6BB9D1A7
SHA-512:	F46C907B20779BA98F7C1FD97C15C744A23993491C1FEF52F58B7E191FA35C8D37C00BAA1B70B7C62401B7254A2FA102759183DEF8151D191E0A0DAC563E4993
Malicious:	false
Preview:	..J4...'....- $.+5."....7.]._...."...h...bl4`....j.x....{.ozrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4c4067e8-f42c-465d-8429-I).s2.S..d..Db6t.th..z....d.J.....U}...f..45f(.).rKH .\|..o.p.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/<B.9S./.~...pl'.h!..v....8.Y.]...`o..'..i%.l...,}0%.Z..~.5\|/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .q.Xj....3....,);.&4..d.....`.H....._v..j...gk1j.P.:aFl.Z..o.p.s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b.[.Gm.Z.d....2.6.]W..c...4.T.3...}".....9N`}....\|r=.]..n.m.PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/42q.&`....d...V.,N.M4..:.......N..@j..

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26147
Entropy (8bit):	6.58896120903129
Encrypted:	false
SSDEEP:	384:rLpe44TdAyJ4WMhm8CNiHgtzBePMoQR+KvCRsUYeqY6ePosm36qBOcnL:atJ5MFSrUIIsUDPoLLL
MD5:	7C4A5D788914CA47B9961880D8ECFD89
SHA1:	4AB9502F796465E7418D45E589C37B039CDEE227
SHA-256:	010DE4CD45FACB7125654983850CA994606038369F098376E03618C3E5AB6537
SHA-512:	AD6F6FE8C2DCF7F2D00996CBAA3C7CC9CD1D41952C9CB7BC12DB41D9FDA38232FB1A4AB298505A732B5BAEA8E6A3DDCE9347A9D3DF202438255A0868252E9F36
Malicious:	false
Preview:	0...fn.#...'...!U.#F.'k.c.qC...\~......y...A.j4.({...;..,wO0.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{2e059cae-5298-1e16-949e-77b13b447af2}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..p.c{..!...n...{M.}...s?..7.%...:mT.~l.d.)...N.w}.d>...<..>zM5..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeD4EBADD6-401B-40D5-ADF4-A5D4A..Z.kR..S.......r..1Y..6l..b.#V...Iv....F.j...F.84.2d...v..w3.!.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..R.vB..u...h...h..c?..:h.t.=L....7.DC...b...Q.b3Tkl.\....I'w../TM/v2" value="Office19ProjectPro2019VL_MAK_AE"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http.1..a..j...'...2..`Y....J.-...G^....F.{...P.p>D:3.O.;..a'S-.ity><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4A15-4F.3..$..2...f.M.$2.HT..~*..=.pH...av....

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11952
Entropy (8bit):	7.044466308557277
Encrypted:	false
SSDEEP:	192:686K0CAmOnyRdmDecfDregv1BXZK9Tp9k7TaD9:686KYYRQScLigv1BXEV9cG9
MD5:	48A752B96E3E6044BF1D8C5FDB898784
SHA1:	57FEB86F54493D6B5AC3EC2AAFE89B13DA66F809
SHA-256:	BC89393941E8F992E5724226015E7465C5EA2DFF2DB2BEDECE2F3393AE1BB63C
SHA-512:	0C05B8C7D0ED3ECF0A992A64D71BF075CF1AF90C51FB165F1668A7183170F479DE5AC337C56E032EAB996D2390A7A5E5EADA3252E33CE32314EF44A710E32D48
Malicious:	false
Preview:	.d...`.....s!.P.....a...b..~yC.R~6C,..\.)8D...J.0\|.....6.{d.l.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{717cacfa-1355-405e-9c0a-d..~Y.W.Bd/...A...k....t..-zT..1/UdR.R.'z.'.Z...J....+E.6p.s.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...j$..S"L}..@....%....?..q~G.P:{.Ty...wjo}..G.;/......u.*'.%.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19ProjectPro2019VL_MAK_AE"....y..Y.3y".Z._...o...g..V{H.LyxCnG...5<Bf..D.c-....G(.d2.m.pertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.o!....(Y..EYy?.[.E...o...J..AvH..5~hnQ...ftOU.\^.6l....X.wA.).4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExU!...Q]..W4s`.X-a.......C.ZOTf..Qq_.c..

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20296
Entropy (8bit):	7.117340983704285
Encrypted:	false
SSDEEP:	384:f/dAxufgjbn+yGZd85Tg82kcadYyM4ixFy8V9:3EX+ysJ8RcaCyM4y
MD5:	369ABC478754556DDDA36E967DC0881E
SHA1:	B8B7A66C5F711F0FFB7D0CF8F804ABCB44C867DE
SHA-256:	E4B6B812FDF75A6FF6E2989969B72ABF784915C70C3D1AFF5C952CD5698DB045
SHA-512:	8750769EA8D36B5F94B927AE36BDDA4155D8CAD7DEB35CD62338BBC23D02E234AE21DC99ED11F4414227CD3767F73AA4C567579424662938352D8B0F311474D7
Malicious:	false
Preview:	.;..aJC%}.z..~qbE.H# Ch.c....\|K.."i..mR.!..I..._....F$OB.#.g.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e51df738-24cc-4ffe-9038-M.E.g.K.?Hy..5>t...~.0./.....\..mp.V2B.%.......c..z.#..<..7.x.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/:.<..@c.oSK.Ja,.F..7d.<.hO=..{O..f$.f.P.wD.K..._.w.+F6.S.f.;.:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19ProjectPro2019VL_MAK_A;.,.q@.(3$r. on~...d..v.".H..`m..i!..3..^G......\..u..C=...s...ropertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3P...q..ymS/.Jos`...j3Cv._"3..kz.."x.....jG.]....F.4.4Y:^H.~.].6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlE.....aa.iH&.'e,]..4nR,..K4?..t...z../_.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26216
Entropy (8bit):	6.660220975737494
Encrypted:	false
SSDEEP:	384:B4ifgwUxGJ2uflOirmEMPgzqrs3en++erR5LUdeb5sbUnK6tXohNfWPCBjofXvaT:XP7rn420sOWnpb5swJMMxn+Fx
MD5:	E5A4485B0583A65E8B03576DE89828D7
SHA1:	9730A9D77F3910D5F3AA9D350518C321A73BDD19
SHA-256:	D70A07BA2986A6FF615F0A80AC060D4E29E021C649BF87906AEE1567AE2AF2BD
SHA-512:	378BCD8AFD70F4EEAEE5A2B7E990540E51C11FF594F431BFC62CF1208C00DE55F8045D2EF5EDAE9438E775F300E31133B5E1B0834FB0FA6897C84EE93FBF430D
Malicious:	false
Preview:	.7.0`..Vk....eF..c..J.r.4K..5..E.k'..-..6...0....8)..0o8IA.FB.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f147a791-903f-478b-13a6-1611809cce63}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.. .e;..i....zM..?....&.e....b..b.A'..?..f..?....tl..*hr.S.DG..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeFC7C4D0C-2E85-4BB9-AFD4-01ED1[.xNj.......iM..7....c.#H.. ..B.c~..a..%..7...."6..:"y....S.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X...>p...=.....nA..=....o.;J..:M.@."%..e.-.. ....{>...NO.$.~\|\/TM/v2" value="Office19ProjectPro2019XC2RVL_KMS_ClientC2R"></editionId></tm:application><r:allConditions><sl:productPolicies xml..t.3k.R?....}_..?....d.1P..?..b."R..^......a....tk..7spR....^0</sl:priority><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6ED...!k...f...2j....^.%.n........."y..b

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	12173
Entropy (8bit):	7.041699327737713
Encrypted:	false
SSDEEP:	192:TzoX8HeyAz44liw4KHvpthhBQBFdK+auSshHI4hDA6/uAZ/1n:QX8+PlhHBthh6BFdKrupRI4Z5n
MD5:	3BDF5DE76C78E81F6D81BE40FD8630AE
SHA1:	86E4740E56CECDD2D09E29C9A113EFA1C165D5D6
SHA-256:	D5F8657415C2DEBD46D55DEC7F26B8568500C0BF6D20B3E2D1DD4E3DF1CCBC0C
SHA-512:	55CA4FA88B7236FE1F811C6678598D2C45D944E142FD0D3F037C902C2D259DFA15A05F86C1A508043800DF547C59F35212366B229535B936F7B07A0EC13E40F3
Malicious:	false
Preview:	.Pe.ANsb[^^...~..l'.x....e..kj.xu,...\#"B....R..G.Ks..#....rC.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{943a8c7a-1830-4ae8-b6de-r..IT(<.NY.]1.."x.r....s..8i. 0c...L-&Ll....{0b..{.....q\.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/U...&DSBI.o...#E.rd.<....8..dm. wh..^ss.\|...^..LU.d..:....n..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19ProjectPro2019XC2RVL_KMSN....XjMIz...Pc]. N.$....c..kk.{kv.....]p.b...]..h.B...$...>Q.pid"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http+....A0yH.T..P#W.~9.q....b..e'.{k......J}.)...v..\.[G........g.jn1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZc...gLb>Pn..%B(.z".c...a..aF..d....FD

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10076
Entropy (8bit):	7.008307407264539
Encrypted:	false
SSDEEP:	192:kI/mmoB6GaEe0POJp6OV9DXxP4JIoihOL3HgUyrU:kmGkGaLoUp6eDBP4a3hGARU
MD5:	CE7091C1EA1AA2B22ACF4BC1F89AA424
SHA1:	DDBBEB31FA81E57FB33EA4D0CDD9A9EC5DEB5B2D
SHA-256:	E9419736262AA916DE0F3AE8A0642460CAD143B31F846C22023C30B38EB0AA2F
SHA-512:	9B72F0F7C1E6FFF1C9BDE1EF07924440D5147021155DD1F1804CD8A169F5ACED25DC14523EF1E524898CC4F2BC2A8E738EBCA190290DABFCB2C95ADC6C3437E4
Malicious:	false
Preview:	.7.eex..:r..n.)..-)..$sA.U.H3.-.u.$ia..{...W~..xR...6$k...I.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{6221e4bc-c8fb-4192-8d27-<..oid.A(`..`Bf..cvF...\|?W._.K$.hYl.l6q..u_...'.Dd....n.Y1...V.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/M.rv.r:;(+..2.t..3j....-x."W.O7./R8U\.c..+...[..sO.....!h......r:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19ProjectPro2019XC2RVL_B.l..l..tp.OB...}"T...-XZ.C.U'.`.?I&#y..5...+..pN....c"ka..._."appid"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="h}.Ocu/..m.3.4..=(..x2Z.].U=.,A?I[....>9.Nr.[N...0jfR.E.b.cWOjn1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K1.e+jq%.KV..e54..\W\|.j_P_`.i..M.RFO...

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11085
Entropy (8bit):	7.05006700955225
Encrypted:	false
SSDEEP:	192:tR33tugT8DDl459TXCWeyHmjbmmMEVhmt/WtuSp9fZ6uUH:3boy9T5DmHmp0hW/FaRkH
MD5:	6F48A9BB83A24A4C3B3EB87D3BD11149
SHA1:	E0A04284A762F5A94954448305FA34CA5E63BB8B
SHA-256:	51329E96A3FE08B87C8FD50B90AB7FB375919F72FC566048ABE371D9C29FF737
SHA-512:	CD14326AF5BC84DB03FD093291B8F4BA9A2884187A68D3567374210F37A54BE0F3F865C1D6D21A7E1F25289FE98E377C05C2CD24884F7EA645A4CD24DB042BF9
Malicious:	false
Preview:	...\..U...[.d.u.gfD%4.!-..>w.?..a._...-f....~e..5..B.7_4^0e.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{13782cbc-b28d-4a3b-9924-h2m....AC..U.+.%D8;Ntl.m;...=`.z..w...{#$I...6Y.._"...D.yJ3z.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.....V.=G.)..9.v.$r.n`.*p..9s.=.P'....(b\|.C...rh.......bE5[=?./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll )0+..I.LW...L.e.j.jg.=r.=....lb.v..O....3/(....t5.....V.bByJ3z.s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b9.m..w..E..3x.{.gf..Ceu......~.S..i._...E-7H...cH..8....eh.K.g.PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4.0...n..#.#J.Q..^.gG],.......%...XS...

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26151
Entropy (8bit):	6.613007893497015
Encrypted:	false
SSDEEP:	384:skOryRUoT4CkBc744fCNKjy4Gs+ePZIHRhWoWTsq36R02LO6fIzLH/aVIenc:+GH8CwK4ESr4GXUoGF4VBVhc
MD5:	05F0DE4F23446128C5B09ED680ADB24A
SHA1:	FF9E3CB8DBE98EED2F61A3D9A40D32792B3570FF
SHA-256:	57B65C86A890C1A8C816DC0DFA5F1EB0265DF2ADBCC5940C194387F853D1B72E
SHA-512:	F795FC798F6DF21B68064EB6AD1CBE364A0351281269ADBAEA4D4C2F395CA08EA6DC39C582C871207B7F9003451683CB4EE25D55F0AE3A46E72196DCDBA2BD0D
Malicious:	false
Preview:	e.`.H.aO@;.;...d.........2.hf6N....[.{w......4r.z..e...}P...[:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{ecddbf92-401c-6a25-bacd-434675f712c6}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.>..M.t.B8.'...oW...RD...@.f.<1:A.....i........);.6..a...5B...B.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office73FC2508-0FB1-475A-BD6F-2D42F.j.AIM.0.5i...o^E...Q.....3.:s1.....].7%.....fr.`..`...?...P15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X....X/A...Sw.cD_..~G.....%.$i........3g.......<u.9..&.. 5..<./TM/v2" value="Office19ProjectPro2019XC2RVL_MAKC2R"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl=".&..MT#T.:_$...eCY...@]..6...^sF ...L.vk.......3n.3..7...3B..JEriority><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4A1...OC!.".Ad...?....f...L.j.um1.....*

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	12140
Entropy (8bit):	7.084629029976378
Encrypted:	false
SSDEEP:	192:vce8F5w01UUtII83eKIYBLv5erW3uduDS9SBupbSn77MwRQr:v+FKWtH85orW3EuDS9ajvpRA
MD5:	9F12E8EB16AC36993CEA62DEFE428DEF
SHA1:	2E46E7CD22FA31AEF5C6363A26D6E98288818F27
SHA-256:	0A3C8470020B725559FBD2E1EDDFFEDDA33C5E76D17AA1E04D46E480D17DD48F
SHA-512:	B7C391C1FF367AF8EF1AA887BB75829097B564A98746C5712E1CB537E588EEC1B5F7EF91735461F853C6FA5759049020313138232715AA139AE3474F773DD2C7
Malicious:	false
Preview:	B0.}.Dz.)zK..HB..L.t.........\.b.W).t..N.Z.y..&.B.I].....N=h...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{566ba101-622d-48d4-9894-..V .X$.ln.........).........-K.'.N?.+..J..Sp..t.~.`7#+....p\|...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/../n.NZ.;#z..W...R.`....E...)X.`..o......./*..+.I..J.....l+.X.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19ProjectPro2019XC2RVL_MAK.0c..8.3m@..Mh....)...G...&T...Oq.>...i./..$.b.A.MQ.._4&.^.:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www..L..[8.9<.........)....G.7..^...O:.r...].6..).E.[B....Xav.S.Iy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQR.....kM.FE....o..?......H.!..h...a....

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20398
Entropy (8bit):	7.140376176754048
Encrypted:	false
SSDEEP:	384:I2ZimYAkNOukDFGWz5APFrNqROK0l+pRB7lKHQ7:CPaDFGjPFryOKswBpt
MD5:	0D47C1706B6ABED4717D71BBFBAC4970
SHA1:	8A2ABF23339A801B3E6C3BC56B524AC42816A5BB
SHA-256:	DFB5648BC24F2D2883812B1E56EE8594B504D3EFA39A0E999784ADEA6F7C17C9
SHA-512:	109650831748F700EA65275AB1B79A464DE6C69B3307871A224EF02A2DD92A21359D7E12E9EBEE4E436EB2F8364BDED35C941D2846B443CCEFCC620A581AF398
Malicious:	false
Preview:	.H......o.?..i`..].,...i\|.....p./j.b.7...\|.n\|.@.#.m..Z\|y,WG3..7=rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{96d01a3c-7ffb-473f-a97a-m.x..W..Kj.."/...q._.10....g.j%.t.h...r.9u..Ik.[..{K!.$.~..(is:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..P.....}W...v=..C.8.E.`w.....t.-..$.C.D./.lf.@.#.m...Cy>.V=..ku:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19ProjectPro2019XC2RVL_M..^..B.`.`..Xb....p._.e}.V..-.bm.h.1.F.&.{..EX0.l..Ev1~.O...f9<r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://ww*.j.....`Jj./?....n._.k1..V..V.hf.e.z.....m3.\.x._.._Kd? p4.6I1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRs..q..5...+...46....S.c.oP..Y..Z.^'.G._.n

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021DemoR_BypassTrial180-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25754
Entropy (8bit):	6.658206076118276
Encrypted:	false
SSDEEP:	384:ycObZuJ4z4GUGhs3CNKv39GePcWWesgLOriin3PmxXmKuhQdy2nyUXMW4:WZhzha3S85VkrX3POWlkXMW4
MD5:	F44F9D47593A124458B0161AB5804CCE
SHA1:	0350F12C72B7F0D289A67EAA5CFE2C164292C809
SHA-256:	BF87F5109FFFB4FFF17180172826D934E9D375DAF0FEFCA535D935864C3E5685
SHA-512:	3680C969C52CA3F1701668D47520C77753260BCEBAB52CB4C3C21BB7CA51DD8833BC2E8EDDC8F0C5DA19B5864100066FDFDF8DECF09A406C2F795FDD77E23C1E
Malicious:	false
Preview:	......h...T../....{....ma.J........j"p..........k...-..c}:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{aff353b4-2148-5de9-e862-c476a5e11a6b}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x7R....}...C..0...M%...25.....<......M ........$...g...fd.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office759C4ABC-9216-4BC5-91F5-C089F......G..u...#...Ei.....n`.._.......Z8$c....G...s..l...rv15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X(s...H......$...O;.....lv..E.......^zsk.........kU..Z..]!/TM/v2" value="Office21ProjectPro2021DemoR_BypassTrial180"></editionId></tm:application><r:allConditions><sl:productPolicies xml4M..A.'..A...7..M<....v+..@..<...ef1Q....[...v...e...##0</sl:priority><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6ED.....4...w...x5...d.....5=..h.._...Y

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021DemoR_BypassTrial180-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11999
Entropy (8bit):	7.146873867440128
Encrypted:	false
SSDEEP:	192:GrhpvMpnzLPHd8befW4+4FT7OPOFU4LBWmyLW2N//HhyQ4:abv63dYWW4+WvaOFlQpWSHHhyQ4
MD5:	EBA344D328141DA848128F311B337533
SHA1:	BE4CD7E3E1481A5BA28AB84483FBFFE8FE4DCE48
SHA-256:	7C3AEAD61624F1F1B32185604BA8420D667049ED63FABE1C1B63C8BDB0463493
SHA-512:	D6A43E60C7493CDCE4ED2D5A1DAA03478C2522E956B4D1197E1CABC893BC8903C0670D76AA0111F279389A17A4375EAAADA34B12CFABD3C585165FF56471B95B
Malicious:	false
Preview:	D{+.K<^y.............@...........P..k.G....56....B'....w.....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{bff7fc76-8d85-4a44-8ede-...Fq.".M..q4...C....U........K.F].{.C.G..co.Q2 kM(...-....Rs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...,6~Y.U.#`...._......I......C..m.i...W.::...E.0.....&....Hitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21ProjectPro2021DemoR_Bypa....%_$.J..09...u.............^..^.;...I..c9..!.K@...b..Lpid"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http...3.b.T.k9..............V..#.ws.0......e.....R.E...x....sjn1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZ.....ay...[L.......Z....9..7.{z.q.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021MSDNR_Retail1-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10999
Entropy (8bit):	7.177275863554955
Encrypted:	false
SSDEEP:	192:MXavqCvUBj3m+zD+kFjK02Zav9EGuVtF3QaQGLzrofRNk:E4G+k0TZa1ErV3pzr6k
MD5:	6EEFB3A71B2B473300D5D82EC50F077B
SHA1:	A09686D8C5F4378F71FF77299BA42893B7CA7D80
SHA-256:	654407CC17BACA7198F2446DBC96FA6F1C476B02D4BDDA8E869D31F64AC4CA10
SHA-512:	9873D89EAA10D4213F07B71542C18193FA29A55FF30A22D5FB82F31EBFFDC229A6B9048FA74F63E49FBB03C8CEFEACE6F3F67B2667EBB7F0E990DE0BB722B773
Malicious:	false
Preview:	..V.....;.w...WBz.bF..w....T....F.x#....DIv.`.-,...).......rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{947d3f03-b33b-4528-8965-.i.....U+.5.......'.3..Ea..I.C...P.'3...@.@ .2.........E.....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/+........b.H....I.nM).......P......5c....J.}.O. :............./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .=....../.k...KO{Kz...U..M.A....h.,e..LQIs.e.}c....5.......s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b........x.R...;4.."..3_....]...N.x..Im.-.4..(...a.(..6..PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4%=....ex.B....${..^.6B.......t.02.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021MSDNR_Retail1-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25836
Entropy (8bit):	6.622093445012984
Encrypted:	false
SSDEEP:	384:kNpfKDsCii/NL3IRWBSd5h5Oey5llSHuVrEt6fhccWCoChIJX75//8i38u/ADW0O:miOUBSd5nGteSoFZF38hc
MD5:	20C688F4238124C79E719C64EE52796B
SHA1:	2C95F71122E0193D5AA6AF3FA02CA815790142EF
SHA-256:	E3997705FB8CD34EB3D1855DB0847387D10547EA15727830B8D99BC5EBCA6DB5
SHA-512:	93750C697C3DFAC2181CB1459928AB399C908C28F086D63C97DF9EAE2A3608ED57DEDF4F90FBC9DBA84E841D566F655EEB3F3660346C1FA7E8742F82D1AFFE82
Malicious:	false
Preview:	@L..p.b.lnc..z.%..x7@........bM.e.E`].k...e..N..>..>)...p3~...u:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{0a396ced-21cf-b057-c3b8-a013ff86a976}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.(.u.w.nmt..~....$i...KM.Z6..j.tJ]m..w5..A..w.Y{f...:{l...l.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeCDB562F0-5F9E-499B-8DAD-B0651..t...?..HB..z....,%_.......W0X. .Ph..u...v..I.G>..!1...1q%..~15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X...`.B.:$..v."..&w9.......T.B.3..)_W>..I~..^..9.V))W...n....)/TM/v2" value="Office21ProjectPro2021MSDNR_Retail1"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl=".2.u. .;o(.p.$../m^..^;..FTX....U<.?...+...]..".\2=F.z}l..kriority><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4A1..r.w."..6..R.~..p.H...SA.F.F.7.]o.Y..

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021MSDNR_Retail1-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11958
Entropy (8bit):	7.063910343354493
Encrypted:	false
SSDEEP:	192:OGP5D3ODH3e+KSBa3V77jNpaG1uPrJAs/SDir75alwp:OmDme+MFja3rJqDw7ku
MD5:	9B507458D2DA07AAE2737CFBE3CD9F56
SHA1:	44DA9A26409F1AAB981664231114ED502D29695E
SHA-256:	D3D20B90F5816C61ADE66C830F218BD1FE608EE21FF411374D3E900E78A02A6D
SHA-512:	67107868D7EB10B80FB6DF49B269082E0853D60D03D2A9A344F69293A739BA85717CC20A5C46E37E8D13325CCDC612F39137213AE17AA361F199D505149F1127
Malicious:	false
Preview:	Di..b..o.W.FW....8.. H..A.>.S.....&..b\..J .....L .:t.p...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{80751947-ac8b-414a-9311-.j..b6..,......LS..2..x...KF=....7.Uy..fR..Cv......{x#I..d...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/....uB/.63h.Y._....\|..)CG.C.9....k.eR..3.../.....A9.y%.3..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21ProjectPro2021MSDNR_Reta.k..; ..x.}.C}.QM..{..+.E.WF6...6..l..3....l........4.je.>..:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www...t..` Q.)W.....LS..a..g.E.v=....6.U ..3....?........@."pb.n..Iy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQR."..PU0.PS...z..n..E...uJ.`1..V...WD..

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021MSDNR_Retail1-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20302
Entropy (8bit):	7.242740263301846
Encrypted:	false
SSDEEP:	384:5UW9ydKp9OH1ybILBPYwi4inGy4mQ3l6s1y4DPXbJXckurmIM:5vGyYBwTKy4mQQCy4rXbJFumT
MD5:	A993110420B54CB2A51DAA3AAF6C0B95
SHA1:	B9BBE9CFA4C1425D47FC2B53A4DC3DD936EC7999
SHA-256:	966305406B6C20EBE3BA976E005880DC3D4A62492E09E23DAB3C2E75566F0A22
SHA-512:	263AA901E84B444C0A4935E3084D7E70BFB7127C79573C03797D88002CA4CA0A90718C801EC20810116059D8AC51B9B8F84D0E4AB62450C89FA74062C99E4C95
Malicious:	false
Preview:	\..D..2;...6)..Ht..(..k.....d....)s..'...e..v.l..3=.......7rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{eae7a675-3360-48cb-938f-.yb.C...x...}f....)..p..v.....+..K.9}..e...<..J.E.;.e.......cs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/....#.. b.&.)tN..`...!..K.....#O.{.+<.;...e..v.l.@.=........:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21ProjectPro2021MSDNR_Re.,?.J...=?....+....(..$..:.....c?.B.7>..:.d.`.y.G..9u.......3<r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://ww.c!.U...=..[.pvU...6...:.....h(.B.nr..:.P.y..t.`... ......C1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRs..:.....H..".k.G..K......W....)&.l.l.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021MSDNR_Retail2-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10999
Entropy (8bit):	7.167069742461945
Encrypted:	false
SSDEEP:	192:TEIkRQ/ubk4oh9TbGiTFp2UiHNcdF/4Q9RLtMxl:ToQ2ba9Tyyp2UiHNUnGl
MD5:	DF277113E48DDECCA0500C9BA1241BC8
SHA1:	ABE09D0E205C6D7AEAFF4AF8F98F517F8EF8EFE2
SHA-256:	8A5CDCD821739074187D32419A9275BD46613038EDE823559B7FB5E74DC04C98
SHA-512:	D3697E53FEBD1A6AA9F068213ACC3742D59C0841311DD0AC74AAA85D5CB27A3981B4A5B84EEE2F261C6B4E2BDC3056FE4F6185C04DB636833244F3FA222D7E1F
Malicious:	false
Preview:	+......'...jq.{hZ..I...V.........w...k_f.B.i.x....S.0G+j.....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b20c44bc-cae8-4df9-8242-.Mx....z..{.d:.m8.S.C.............a..e[h...?.*....er.hyX0.....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.(..........6n.7kDO....].........1.8.).L.b.W...;D.mg~p...../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ..:....v.".}q.rwF.....J.......Y..1.d.W.l.}...-X.$[~w.....s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b.1\|...#..{.Il.[z6z.N..l..?............ ..k.2.,....E.u.y]....PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4......./..$.{(.w..j.J...i..M......E..{

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021MSDNR_Retail2-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25836
Entropy (8bit):	6.629053552017183
Encrypted:	false
SSDEEP:	384:d+cwksRW1tFJUYDBJu6vp8iemu5Y1u78lnzsq6Wh5W/CdaXgw6BsweYsUXS7ul8Z:4AF+oBJu6hZrQbhQNe8Xqh
MD5:	A9387985B169D0B2356CA38FA302887F
SHA1:	58C9BB7E6A50503806C337FD2ED00E9DE5C51AD5
SHA-256:	B9CBCABEB3BE2F5B3101AAAAE63312E227C97D1E06D8E082095655802EA1C20B
SHA-512:	349C0682006F04412E1F6D6D6D7392460B84BB7371A6AF8BDD153919D63E350493CED02312F0895B2DE473944600AA4953D6146ECB3457D01E8CE3DFA5C6E30B
Malicious:	false
Preview:	...q...rW..U..h\|q.H....d...w`..F.Q....N$.x....A.. ._.<..&...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{5eb693e3-bf1b-f940-9f68-ee4af6233fc1}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x"...t..pT.....c&i...k.H.5...#7..a.{....>K.b.......o.E.vS.+....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeA11DD968-47F8-42E1-87DF-3EEFD}@)......q?.j..c/ ..W~...s...%u..A.Y....".2.....A..8.U.}Y.b...15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X=9].a..$.Y....o5:..1h...k...;oM.C......^u.!....F... \u.KF.v../TM/v2" value="Office21ProjectPro2021MSDNR_Retail2"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="'.e.t..%VU.O..i2<..VoK..C...Aut...d..R&.1.....]...4M..6U.w...riority><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4A1zY%.v...K...3sk.@I.<.9...jk..\.^..

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021MSDNR_Retail2-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11958
Entropy (8bit):	7.121055909466588
Encrypted:	false
SSDEEP:	192:mzq2E+5cJwnP1SeJg/hVQqEGW0TMY5kHuaziQ+K7gy8JxEks:mOv+eIP1SMgLtXW+5VC/UrET
MD5:	F1D7F3BDFC3A7366C751A38450B8258F
SHA1:	95434282E8D2EB97136924563A64FCFA306A11AB
SHA-256:	57143812B07D32E588351CC68AD46005CEBB8EF6AE26E02B2D6794DC3B9324BF
SHA-512:	72112BBC0C3025BD89DF75F3BE9EE8FE25FB0756F0C65BA80DDDF60C5A88049C39A1121BEC97B271C44C4BA60F6F9FBCBD2FE71083ABD03A90343E9E4059322D
Malicious:	false
Preview:	.-....8i?.[..v..U..`.....#......2....U.?._0...m.$..C.........Vrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8c0e7734-dc44-4206-aa74-[.S..07y....=....=.._..>.[....}....E.;..g..E.%....b%A.......s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/).x....I-.j.Ai..V..tH.S..........u..W.n.......{.w..D.........itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21ProjectPro2021MSDNR_Reta......zw%.P..s....=O.H...c.[...+...M.n.l;....z.6..._.........:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www......z7/...^&....=U...... ...&....K.n.X;..K.I.a..Y.;......Iy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQR..M...VP...W4..Z..q.e.....,.........D.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021MSDNR_Retail2-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20302
Entropy (8bit):	7.2445587317637
Encrypted:	false
SSDEEP:	384:LtbGq+f/IyaFMyGKALomqzb7g2M6FyXV/O4zvIFeUN:LtbMghiyXcoDQqFyXMkXUN
MD5:	9E31DF660F26E2F11BD67430E80F680D
SHA1:	DC4D796D99A375AC9BA3F99F435CF79B6F0C579B
SHA-256:	CF7589FCF6E0C8F0098F71B16E46F0A3CDB95C084BD0C721AD9BECB8FC3471FA
SHA-512:	56EC5B6A7A5410E4BF9776C7115506EB003663D6C31ED5B7AC773A753D84C0AB406970F831AB2FB5DD9B9DAB1906C127EA36642D98A483C13DEB7D91C33CA6A4
Malicious:	false
Preview:	.#.....Q..........C...@)..\?..5I\.L....9.<7P...+'.`.S..x^rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{891ac0cd-6dd3-42f5-a3d8-a.2......B....M.U........F.p..}.L.H....o.n.l..........g.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..I.......<P....I........O..F^x..M=^..@.....<7P....'.,.]..$.:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21ProjectPro2021MSDNR_Re$.m......U.....e.K.........5.E.8..tOB.HI...9..$_...!o.!.N..)Z<r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://ww'.s.......AO.....V........{..h.3..t...Nb..9.,lR...:...T.y1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRs..h.....t.8K...b..........o..a-r..Z!..

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021PreviewVL_KMS_Client_AE-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26054
Entropy (8bit):	6.701267557962231
Encrypted:	false
SSDEEP:	384:velIB4NCl2lVI4EPsi6g7CPC3t/Se7c5GuDoSI9KmszrmpXsymnWLCFW73PSnKBQ:vnAqOPOoKnszq8AdDvQ
MD5:	0E1B6D04E77462CA2136AE383DA50C51
SHA1:	CA4D0FF76259BA73CC340D54FA985F76DDF9C21E
SHA-256:	B56F6D502B6676E050FAE0002AAE0F35D118B49CE5183CC8E8995A1B7D7F729C
SHA-512:	706BAFBE565966F5876ED0A0CF4458CA23CC78685C9F87BF27307D0324B56D22043C12E62A816972D50F0FDE8A5D9BF24A5D492C32E6580BB7A6717075D93DA7
Malicious:	false
Preview:	8.....R......w..(......hd0D..tt..\.2p`......p....C..K/....:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{cbbc83b7-b4f7-4302-fce7-e425e22130a4}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..DP..........h..0V....<5o...#x..v..Hb..T....9....Y...=.....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office76093B1B-7057-49D7-B970-638EB.?lg.I......{..y^....os3E..as..T..,<2........p.....I..t....15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.0f..........\|..cT.....kk1S..{=......g8p.......w....i...J.../TM/v2" value="Office21ProjectPro2021PreviewVL_KMS_Client_AE"></editionId></tm:application><r:allConditions><sl:productPolicies ..FM.D.R....."].}L...th,O..=*...~..?.,.:......1........P}....>200</sl:priority><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B.8nb.:....... J.2y.....02m...+.......?<

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021PreviewVL_KMS_Client_AE-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	12185
Entropy (8bit):	7.080063673013324
Encrypted:	false
SSDEEP:	192:/DmHb1hlYJ7oaWa9LAawgmEaBKyDprU8ioKEQ4jhYxCpc4yFxRZh:r2XuJ7rAymFKeULfEQ4jhY4K4kXh
MD5:	C790D1991C2C0E4B6C7615626B50474D
SHA1:	8515AA36F3AF1D053398281B0A291C6BD13F5980
SHA-256:	93F81A1E199507FFE5D31AAB8C85E396FD8025663F19B279365BB507A900D42D
SHA-512:	C6BB8FD67EC1D3AA4C1D0AD07186C9F468CFA4B3042A367E5465FBDCD6EEDC72B19376C6DC8531E76FCFD915CAFB1E622A239FF8D9067B0894AB8E33C3B9E94F
Malicious:	false
Preview:	.(.D............_i.9....(w.'.........p.c...4..b.(.....=^...lh.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c7808198-5ab0-4d1e-b03e-..}.........O...'Kd....da.-....:...q`.g...b....7n 3..-...ow.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/".UWs.9........\wW-O...#.%....}....Zr.2....;..t.{S....$...p!.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21ProjectPro2021PreviewVL_-.K'h.......O..M9.vU....l.1....2....dh.2...f.=.4.....;....o~."appid"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="h..hB............My.'...il./....~....E..8...-..;.4.6...s...uC.cWOjn1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K^.B...&....8..8.j^....f....6......S..

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021PreviewVL_KMS_Client_AE-ul.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10088
Entropy (8bit):	7.163294561744603
Encrypted:	false
SSDEEP:	192:5o/+XpMvKWay+pgo9BTkR74/yY/eQSef4DG:OemvIyUTkNwJf4DG
MD5:	90E313E1B368E5623510254A58B8861E
SHA1:	50B54E30048354F75AF1A73DD9A587E8DBA70800
SHA-256:	0546812255A3D4F8F98070A4F9D38712951ACB55F7B37044B5A0A0F2FB1631FA
SHA-512:	0D6625B6685A6272FBD2A13306C05E3D2E84F060E4AFF89C3B82E75431FB60ECB5A8211617BC9D26AA269C7A24D4DEC82BDC1F5AF636862722BA76EF64E6D36B
Malicious:	false
Preview:	`....M...C./#.........aU...E.bV..PS.!...Y.....6...../..K.....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{3f582b6e-e73f-46dc-9c38-.f&.....AW.j-.....B.9......u...IE.~...W.L..~.!...........s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.VX.sG..............X.h^...J.f......U.........0.....h..._..[..r:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21ProjectPro2021Preview.HJ.ff..H\.3$.........jc..+T.w...MZ.'..._......m....2........me="appid"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns.&}._E..B.*~..........4...AT.i...C..'..$......&.Z..$..@.3..wXhcWOjn1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6i.1^.co..Ug.........~.0...,^.T...Gw.J..

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021PreviewVL_MAK_AE-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11097
Entropy (8bit):	7.125503727229629
Encrypted:	false
SSDEEP:	96:/Smv+C6ZZFn2rJRnaaZDUqoSjRoOK173jz7dVaOq/X69qfyALm7Y7JuY54RBSDP/:/npEZodoXSoPqPD4VQQKlZ5I788ogotX
MD5:	AB925C9683297EA575641D33C3FB0819
SHA1:	3D7DB555D00861FD3702BBE859FBFAAC07B4DC9B
SHA-256:	7A7F9DD8341858CA9B05ED4E8EB2BC0B2CB5DC39A8687654B94805A89E61AC2A
SHA-512:	85F8E0D2B227C21567CB39FFE978EBC27FAE7C4D28F1A45FDDB6E9716DF999E0697AFB120BAC1C63BDAA1D7FB7A938906108580EF449A37320134E6CF044CF5A
Malicious:	false
Preview:	.s)V.o..Z2...k~..q..+,7...fZ....m..R.wO\|V~..#..../...Y..+.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{9f34100f-e62a-412f-9e8a-...\.&....f....}...,..st{...5Y..I..{Uu.\.y.+_(F.k...w.v....4.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...E.e.......'}..e...%<..i]....G+`gZ..8Ur.uV./....r.P.X..q./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ...$.z...N>...ba..p.m&+...1..E..C_~\..u.iV{..)....;.P....4.s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b...;.D...g..Kl....j=...:ez..`..e}.4...U.%=.>.....j.W.n..).PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4...Z.]....8...g..p..39...H{u....G_@b.B

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021PreviewVL_MAK_AE-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	25989
Entropy (8bit):	6.6105406091263115
Encrypted:	false
SSDEEP:	384:H6qw6t44ZhRl7yv7DXo/4VUN7Xl4ee3C2NF6yz03cWGOqEnvzR5/EtDXKEXDlZb7:FL1iXowWN7XaLs5/E9XZrb7
MD5:	DDF6CA49A5EF669F8B2DDEB3CBF01AB4
SHA1:	38D9367582730F81A9F0D260DEA97CFBBF1F785A
SHA-256:	BF7031A92E3E4B79DD35DD1139E75A8F20C75D65970ED47CEF04E68BB9E1B561
SHA-512:	4BA1E892ED2C50A59E77CC98F43392150260D2033EC4F3560FDC8A9B3EC670AABC50F9E1322BB2B384E1F02CBDF630462740EB0FCE8E00E6C2F4794FB1291339
Malicious:	false
Preview:	...+..8J.#c(.y.n.f...M.=.......]..Oh=.0...Ci.h...K]DC.#....xb.}:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{026c83e7-ea28-cde9-20c0-58af544334c4}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.%.d..-.. t4.}.e.~...._.i].D....R..ehH."...Y}.g..Q]....9...u`.d.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office8FA633B7-E02E-4C83-8564-042EA>.XQ..f...Bz.y.e.7....W.:.........G1;.\|....u.o.\.BG[[.)L...<&.v15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.."%.....g$d.u.i.-...M.>.....M....jr.x....w.x.....SC]. ...(Z.!/TM/v2" value="Office21ProjectPro2021PreviewVL_MAK_AE"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:s.tL..%..zq-.>.i.6.....0..[....'..ew.C...[;.x.Z.\.S\.9...j+.`l:priority><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-N._".....x>.. .1.r...Z..[.V.......Yi.l

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021PreviewVL_MAK_AE-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	12152
Entropy (8bit):	7.048588197691893
Encrypted:	false
SSDEEP:	192:CSactrJWOrj3cfyWNvm/RwuwiON8ZOkUQLpEl+7mulTE:ketWSjcvPpiOAOkUQW+7mulA
MD5:	2CA903953ED0CBF422EDF082B04D3116
SHA1:	E1E4689EE7F6A5E6C49DA9A9C251AA500DE0088E
SHA-256:	93538E5901FE413C44FC14E14D8B311490EA47D27DA01FB53DAAF89DC152343F
SHA-512:	7D9226268E8B2084B191AAE149F8D58A11F093B807AF75B754580FD3F4E80F0168BE33F931919B8FB51B1C5B04A3FA31906D758CAA6FC5A71DCD8AA6C08D4900
Malicious:	false
Preview:	M.U.#$......[..._8.<Nb9k1........c:F..4D:r.(.p2...R-.....}....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{744c41df-3b95-4e20-93cf-.k%_.h{...K........e.m.:u},...E.ur...0Jx%.~B"z...8.9....0....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..[F.)...).AD.[..,.w.k26.........%B2.e.hY.'.}$..E*....,....itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21ProjectPro2021PreviewVL_..]6..k.....\.....f.{.t>g0....D..D{...xB.z....w...[>.....`....><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://w./8..u&...O.^..I..{.z.n0+\|...i..Sv...4D.z.1.f$..\|i..._....N1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qR..D..#.....'..@...$.y!J4J....`..]T<..

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021PreviewVL_MAK_AE-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20410
Entropy (8bit):	7.212006501547886
Encrypted:	false
SSDEEP:	384:EGGwpfNbBxDOCtLp3mTIYvkpQzfNkeNWml1e6SQODQi+ImOPkSc:7pfV/DO8gp4Qzfae461lSQOp9O
MD5:	528D2AE6E21C96C310E9FC9ABC54E7AD
SHA1:	9C582042F08B30A66653BAC849BEB885BD1561BC
SHA-256:	61992331B6BF6F58B0EB1E8026718763E5B7BC7F5F187E388A2CAD7B447D7BC1
SHA-512:	613C6E42EBFF69CB594688C70C152A4564EABDD4153CB57B6F64285253B99A9C45593FFDEB4E9829CA2896AC9BCCCEE3681714744678F17B54B66C208214A4CB
Malicious:	false
Preview:	...=.UW@..]...f.._6.).1....u.....z.........."/.......cUZ2\|wrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{9555d387-7074-432f-8a9f-.KP`S.\........p.[.k.x.i...&..'..c.......L..tv..........9.N1c#s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.)\|.h_w`..l....*...".b.8...z..'..?F........./........r[.` ?:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21ProjectPro2021PreviewV&$\|@{r{i.......f.Z.].{.1....rI[m..h...F.....!4..........&.W,.$d"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http:/E.Fv.Z..._...8..W7.f.0....>I[..E...K..B..!"..........s[a.e#1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0.)BPbA.T..o..<..EZ.9.3....Q$T..L5..i.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021R_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25763
Entropy (8bit):	6.692094573899964
Encrypted:	false
SSDEEP:	384:yhXaNV4iobhMx+yTCNC7bN181ePwZqqlRlYr4f9SQ0iUmKTnTqCGzJ:DypbhMxTTS2N1YrlM4LzUnZAJ
MD5:	902615069F927934B041A0817BB5A953
SHA1:	3C8E3CB8BBD46FBF2F89D860C5F01D54A22E51BE
SHA-256:	2F1E9CAFF1825153223AA1E7330C0389950A487A176EF286EDAA5202A45B07C1
SHA-512:	001E82E6291869B67B887006E8E9B999C95B174C7953CE2D4DDB9AF0EA5B163317FC83557463E9B6C9C954A6AB0C39C2044AB234DFF6AAB4EF5E29C653449303
Malicious:	false
Preview:	?.v....1I.J....-..,L.))..6!Td..,".......@.E5e.....Q....h.t:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{ab1cb94a-fdba-dec3-a9e6-415862e7e567}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.(.....3J.V.....5..y..}}..b{.3............O.X\|s.....V....j.m.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office12929E46-26FB-4DD3-891B-61D8C.....U..Ao.....\|..3..8.9.7v.q.+7.......G_.5l........@.,..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X....7..g........f..U..4*!.!u.k..)l.........P.M2.....p..~.P.(/TM/v2" value="Office21ProjectPro2021R_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:/.3......cP.W....b.N#..5..`giO.kt..........W..t0........O.o.ny><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4A15-4F88.\|..N..'.......J..-R.?+w.=$S`..7".....

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021R_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11953
Entropy (8bit):	7.08920681600055
Encrypted:	false
SSDEEP:	192:3x39u3v6RH6I6FwuR0lAPvtmLPmmTemq32sgbQ7PewGjC:3R9u3CxQwuRyavclTeh32gVGjC
MD5:	D0316219DB3B503030C73926C3C93237
SHA1:	F62A75CDD34CB9EE4B32D7A61316720DA007EC65
SHA-256:	66D09FD85ED30F390D8BB28B3E2E421CDF0BAB3986C02AEA5ED0AB8235E6D434
SHA-512:	FF1CF63783536319E1BAEDB161203152C9963E67B434111C229E0F59DD062D540E61A4D11ADE6B4296F9705A51329C5D87061C5EEDDA995FAAE9E4BEC9E51E76
Malicious:	false
Preview:	@........-.+.g..(..k.QL....I..[.-a.,..c. ..J5.#....0BN..jY..N'rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d312d87c-a300-440c-a4d8-.\....Q.?.:.,..x..6...AD..CQ.L.h..:..s....Cc.q......u.5.0...Qss:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..r....*.t...x.Z+........S.K.._./&.j..a..~...:......7OW..;....iitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21ProjectPro2021R_Grace"]<.........#.+.}..z.y..V....A....5r.8..-..}...4.}....&..G.(D..MxrtyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org......._.#.5.}..6..y. -7...L..Y.3Y....4..p..F..(....s_uJ.[M...DBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrW..p....M.)...A..W..v.6!>5U.n).[.<n....%.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021R_OEM_Perp-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10987
Entropy (8bit):	7.181095753665661
Encrypted:	false
SSDEEP:	192:Ja14D/UyOpRODEgDWfEarDtf9wxVRiqgtvFbGKrK+z:R/URpROZDr6l9wNiRGbO
MD5:	ED5DAAF5823B1A5A555E25CA5A7B464A
SHA1:	5C4EF1EE5AD26DA198606425BFD0F4AB977543A3
SHA-256:	9BB88913C82911C401374F2C9F06ECDEC5F0E0F899D156491539FAF6FE184EB9
SHA-512:	77238D222793201919D7ED9AC6D157A0B23E83B657B879C9B1D9CAC78749BB65387E0B284E388F8DEB982A2C7806B4BBA8060F1E89A323AB5CB057A4E69F2AE7
Malicious:	false
Preview:	.t..r.2...+......N~G....$.\|..F.k....9.....'.J....Q.TR<:.7...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{530a3c6e-a6de-4c3e-a425-.;.{.j...v.....E.!.......9./....$..)...@.....S.+x.ued....#..Ws:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.................P=S.....N..s....,....y....s......Z.C.a....2.../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ..(.,.:...'......RsF.....1'.+..A.{.......L.'.M...R.._k(&...#..Ws="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b..n.+.g...~.....".%.....;%....).l....0..I.x.h....S.B_yr..."..hPKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4....&.9.a.!.......F...&-.a...T...(.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021R_OEM_Perp-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	25768
Entropy (8bit):	6.608203780178811
Encrypted:	false
SSDEEP:	384:74u3Ba477Rm/tGadCNlwga9exndePT38znZMihWBdJ2qzvMb6X7QmMEPnxQM:7rrx0tG8SlXRraihmJHP6a9
MD5:	8A485BB7A2E7483F3D8A7446A58B0762
SHA1:	85FD349B42849A901849F80544B8983304A4F60E
SHA-256:	68EF66288B9A547B823071184F863124EC7D98AE7536293E6D7B213D8CBB9B5D
SHA-512:	5BBDCE4868C4BCDFF17235C005CE9E759505FB043FDDD8B56346CB956905B098152696FE2D6EDEFD5960491C33BBB8283F4C77CE1D0D8B4C8904DB3374009F24
Malicious:	false
Preview:	.L...4.z.n....1+.]...earP.q.V..<m.....8L.9.~}.6ST.`.S.B$......:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{df5140f1-f1bb-7157-aa35-bedddb310f46}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xi.B.!.+.m..c..:q..._.w5&..%....3J...H#.#.zr.+.BQ%.W.En.......microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office0C049CCF-B2B2-490D-A9A9-61224=.m.}.6.H.....:x^.....puG.p...yj..L...jJ.s.^z.dS]...V..e...U..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/Xv.`....9...e..6bD..s.e\|q_.f....jh.....(..`.xm.>T.^w...cS...)+./TM/v2" value="Office21ProjectPro2021R_OEM_Perp"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="httt....;.8.q..6..9b...W..VQ..g.t..MT.....u..s.~q.1TH.*....m.....rity><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4A15-4B......&.)..l[Nf!.)...{5 ..y.H..w{.V..

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021R_OEM_Perp-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11946
Entropy (8bit):	7.040564716988751
Encrypted:	false
SSDEEP:	192:eApWan9ujB8h50TV9B23UjmuST8uPvUV6VvN61fV2tQKI:5W2kjBqOB1jzxuEV6VvIktvI
MD5:	892595125713C52F922B5BB37D6F047A
SHA1:	D80A061B0B83038DFF49220A9B4C6951830E54B4
SHA-256:	337EB9975AAF85614BD3FCE36156BC0F96CA87AC574119375C85AA7B63F007E3
SHA-512:	6AD5AE313C553FE132F0587ACAF99265F2528927F85D0C899F1F75F4EC2E2A441A95CF7CF0DCC67087C3E9AA493BABC95680DEF5D42EC941C5DD0D5A5832D03E
Malicious:	false
Preview:	..o....6/._...5...!..m%..>.Dm..8...R.mq.P...-4O..7...T.f....^/.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b5d4507f-5617-4357-8e81-U\..^.mi......#[J.\|..5}W.#..n.}.....}..^U..{m....n8cIX.F..]0.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/u?......=.n ...y...5B.9,....Kj.:.M..o!..E.\"8B..d...Y...M..Bf.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21ProjectPro2021R_OEM_Perp.0.Q.4W.V(..>EU.`X.qo..7._B.$.....=...E.T3.M..y.".K.r.Z..,.opertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.^....[.j ..B...?EO.,..q.&...TU.o.B.2.+;....Y.4...,..$Q.'..y%.z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExd...$.n;../...<yk.M{.~.0....[.J.&....w

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021R_OEM_Perp-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20290
Entropy (8bit):	7.247565560988532
Encrypted:	false
SSDEEP:	384:0mo5zTHRUKS/5MyONMpN67EDPzEwfH5ry48wYCUVbVZX8P7:+2KS/mysAZz7fH5rPYfpG7
MD5:	571409877B0ECD46A6AF874C4B8ECCB7
SHA1:	401879605F847446A10B995ED021C1467E5EECF8
SHA-256:	65C9813684EEE09FD204810F8DFCEDFF50A19B98321E063491B3869D594C284A
SHA-512:	88695954B52F475AA14E189A8FE1373297E60029BAA0EDD865D5786A693498404B87E7DBADC1347E450C761D723DB47C467DA1EADC42E4ED56799C2CB9D618C2
Malicious:	false
Preview:	..E.-...t:]f`....a'..z..\0&.;.cV.k..+.=........B.........2rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c2ccddaa-05f1-4e8a-91c5-.4.#...0{.&n..../x...".J-,.8..&..}..%.3A.........(.......fs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/....J...fclY<.....d........$.<..a..-.d.n........%.......z:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21ProjectPro2021R_OEM_Pe.!....5"`y.....&e...4..-x.:..-O.1...{.@........8.......2propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w....u...d\|.$*...'e..x.m...0.. O.h...{.t.........m........Ay6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRl.)..E....x.-8....$Y......y.......a.j...;

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021R_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10979
Entropy (8bit):	7.127722003050319
Encrypted:	false
SSDEEP:	96:WzvFmRCZohczcgMaZ5yeiqtPwFQ+kmZcPs9gRqid3adYLK5BxDhl9g+4oG5AZ7Rb:Wzjzn5yfX+siQ4mt8oEuVy7Kcot5bLv
MD5:	1DFA198E0BE77A381EE3ED2B9402FCC2
SHA1:	10B28492D012D530DA7F45E7FB199A528AE3E06F
SHA-256:	78D1973F754BDAE9F7CE427131515C0014DB543A545B034ECDE92F0392C8A945
SHA-512:	35DC7FBB0E04C101C57B7160CBF7B0A0987E5AE20B4C917444D3FD0F7201CE6C522C81964568A5647338E17C1C441EF0866961173790D273E6F1F61CA5AE40DD
Malicious:	false
Preview:	%.}{..?..Y.6.......v.3..s.....6.~.@..Q...... .Y.O..h.^vH'.org="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8130767c-e965-4467-9fe3-.d....d...u.T......'.k..nu....BZ/.6.P.._G...Q.V..p.n.Vf.;\$.;s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.R.h...............=.:..S}....RsV..........A..-.R!XR.H@DwM.i/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .a....7.M.......n.9..pw...N.;><...SK.....p.w7D$.t@C;\$.;s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b.K....j.............6."..r^...k.'...I..9N.......[.Y.. GiA]...PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4.a.w..4......F........&..z,....*s"#.Q.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021R_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25766
Entropy (8bit):	6.712761871791821
Encrypted:	false
SSDEEP:	384:RhBuBW9o4pEIA55CNmPG7hnePbQDWZG8O+gXKyyEFS+TD3k:Mm/OVHS/7hknsTTD0
MD5:	2F5E796C3D3BA8DF8E2F9EF456C82F54
SHA1:	0E23883509FE28EE25F176E4FB1FBFA52B18272F
SHA-256:	B5F05646AECC59D75B3A7DAC7DA361F024620BA1B35E5D0D668949767E354277
SHA-512:	C9B64915054D45976F0D314F9FD110EFE38C5ABE32AD3145BADAAAD43B9848D143462B2F1B551CB596706880692E1FA416EE289960EECD6BE734CA98EE2F64A3
Malicious:	false
Preview:	..........ke.XYo.Zt.....C.....HT!...zG.Y..A..v._...B.Y?....:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{bf12ee13-1487-60dd-e8e9-e8fdc376c951}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xd[<....U...w,.GR5...!........Y..oe...h7....E..k.I.K.F.^`w......microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office3747D1D5-55A8-4BC3-B53D-19FFF8.c..Y.H..9Z.TR<..Hk......B._...OA)..6..J..a..$.V...G..k}....15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X{z...4.G...'.S^&.........T.A...M.h..2W.B..G..~.......x]b..../TM/v2" value="Office21ProjectPro2021R_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:&.%.UN.....jy.C.1..[.......k.L...K.e...)C.Y..Z..a...F...F*=.....ty><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4A15-4F81.j..P.Y...+.......Vz.....W.....tN3...)

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021R_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11938
Entropy (8bit):	7.050960366684235
Encrypted:	false
SSDEEP:	192:3L+QbGvr3kyuRclFVQz8+Bu8y1l0XqghdMgZSxqJ4P7:3L+xArRiFVQz3BubWP1J4T
MD5:	7DCC2892F2AC1C745659A41E9A9209BD
SHA1:	AEF465F7D5422DBF9104D31FB1AA4B43BA48BF3C
SHA-256:	165F493DA1C7639CE6C73341DAEBE83C86CDFB233AFAAEDA720E6C3223FB1E85
SHA-512:	1D42C77664A781DAC3C422EFD39B7C4EA25D45532725DF91C38B928EBA66D4E0E6AC9164A33FBB498A5BC05CEF9081E884C398CDC4E8356D54BAD530C079AA88
Malicious:	false
Preview:	x....2....H.R....n.-\|.ui..{/Nx.>.go.............:\|.....VI.,.`.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{5e201c62-1b2c-488d-80e0-.9x..{...E......1.'-.-%..q\|Mo.{.~y.V............U....0%..8..Ns:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/._V..8.6.\y..M....-.i7.\|b.!y I\|.<.").}.D^..\....i1.......o.)Title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21ProjectPro2021R_Retail"]."i..$...6U.^....1.!q.a..^L!.n.uf.p...J..{....(i....@JC.0.\|PertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.or.")..z.J.\U._....}.!..QL..I'Lj.".^f.D..X...\.....V...0GP.9.i.YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr.WH..~.C.1_..\.........]E.VG.bO.F.i&....

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021R_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20282
Entropy (8bit):	7.189738960000531
Encrypted:	false
SSDEEP:	384:B/+NgE8l7ayEQt5IquD0nAeBdZzdG7n5SMjp:BJ2yEQHIEnBXzYp
MD5:	D1622E4EF39428580F4F7349AA9F81F8
SHA1:	EBD1591E23EA605C347B0E640C1753E7C4759EC0
SHA-256:	285D2CDB2DC02F82D19DCE25FD85C85B7B43D1BFC4ACC238C9F2B47F3B620959
SHA-512:	8B88E5B6131F632B6AEC776D099BCF73BC079C31794A7D56431695AB7010C9CF8EF637E5ECFA200CF872165CDC228536ED1240E96EC52FE998093DB05F435BBD
Malicious:	false
Preview:	...YV.m3x.b..a.(.I{.OL.._........!...C..H..bk<...wN.?'.[:.O.).rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{90ddd838-29dc-4f9a-b811-./m...4li.?....x..&....UI.......8...S..F..k=e..Ag{....(`.[.6Ps:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/)..J1.M.j.S..<V+..o.............d.A.....xK<...wNve...+...uL:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21ProjectPro2021R_RetailO.fJ..a1..k.\|.f..:.SP.........'........9u....9.7=8.Y\|.Q.*LopertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3..<=J[.0ow.>...b.f..v.SP.$}.......k.........4F<...lH..".....B.#.z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlEx8<.?:.Ikl.,.._.Z....>_.2q.>.........7.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021R_Trial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11491
Entropy (8bit):	7.1130027663317374
Encrypted:	false
SSDEEP:	192:HiB1Lezj91fGwPN5p/5rt4Wc7Bym7g5EC:HiB1L+DGqpxnc7om7g6C
MD5:	6BCB5BB9CBEB8BF66B25E40503CB7894
SHA1:	76EC36E3B94D717FAE78996E31D947A84534B2B8
SHA-256:	28E1B4EA4CCE46FAA02F983C34081A7B37DB7AB95137B3D5590933180B60E181
SHA-512:	21AA18FFE73C334BE7618EB26CF9DCFBAE4F2D7785509A65F2DDBAF718379DE9BB7DAF717A0CF075C8699561E5FC48A01EBE95F2CD0A19E4B19B7EEB30460A55
Malicious:	false
Preview:	C).....<.....^]...!....fg.6....P...3.I.......e...Mj..2~..1.....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4082b261-17cb-40ed-859d-.......6..B.....IK~..C>+.+........{.Y...X..<...{Cb..&5.kE...@s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..d......#.A....b...Ool......R.TN...B....,...[a<.}#+.+...../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ..[~..m.....^\...,...]l{.5......5r.K.J.&..1...Sj...n..%....@gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200.......<.......vtQ...mbe.<......... ...M.[..U...u{'.:g?.:)..._rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV.YC...%.3..M....G...ADn.......E.....[.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021R_Trial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25815
Entropy (8bit):	6.664573336990366
Encrypted:	false
SSDEEP:	384:kMhS9VN3j40gz2H7AFSZFWAtk5j2oueeDVw3sLEZ56Jh3BWKJMcYvHthRcsODxCq:GNT17hO56/LDcRgxZ
MD5:	A6DC9D214112A8538DCFBF1896D105D5
SHA1:	7557E3E17B540D3CA964258EB1F93E6475161E39
SHA-256:	FFF20197543A512276F2879BC12B5E910AA90B782523C8ABAD056D3DE9CC1D3D
SHA-512:	23C40EC1D85FCC9902DACFDC43B4E9802391723C0B84559304F80D4E90928DAA3E3699028E92666107C6B6C7CA8AD83D07D455170B7237833EAE4D25F18AE11E
Malicious:	false
Preview:	.e..6WV.m2..X...ND..9...f&....<..-.....s.U...w.^..).`..8....:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{693c1482-046a-3f12-dfc2-949091551331}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xO..3BC.o1.......\F.lD..2w........"-....t.i.Q...>...-.gG......microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office6EAF303B-7D0B-4225-BDB2-B7F23d.0.......g.....N.&Q..a1......;..t.....9.u..w.D..,.-L.c...15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/XP...&{v.;v........D.@G..e)......9.A/....J..S...p....j.Az.].../TM/v2" value="Office21ProjectPro2021R_Trial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:/...'BR.?+..M.......[n..z......{.P<....U.&.U...6.N.6.)G.l....y><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4A15-4F88....9...{q...O..G#..8...d.....'.P<...

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021R_Trial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11950
Entropy (8bit):	7.061197811810346
Encrypted:	false
SSDEEP:	192:0g2o1V1MKtoPrQUW0lq+dWjWW4gHTojolArP8R:0g2wMioP7L/WjW+zoU6rP8R
MD5:	2EF95E640B6094FF0BA624E1B872F39E
SHA1:	902C7C310B5A917A572BF34C0D3E594EDE0DA862
SHA-256:	0587AD6198872F57A0121BFD7848CA8B37B6453693C63FB663D04925ADB988CC
SHA-512:	BC0450ED26F97D89EBA06B38973B142B514D6FBD98061E6F92455A282654EB2DC5E3236E28F7C304C3CC3D24ABE3C0D850D9A7120D8BF24DD2477B40D3286261
Malicious:	false
Preview:	H.c.....D..2=n.@c..H.f.y....../ig`...n....F..t.._.+...a..?..N.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{bdba26c3-0358-4446-a7ac-.m.[......@..yrx..<]...>.o.....j&~v..`..Z.O.&&..i.A..._..r..Q.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.......Au.I-`".^ .C..o.$9.....-."&..>Y.J...sy....<..x..n....itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21ProjectPro2021R_Trial"]<.).^.....Q..(!i..l....e.h7.....7z\|t...q@.....s*..\.....-.."..M.rtyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org.i........L..(;g.@l.e9.H.c .....1Q\|b..."..+.J.N...c.... .+....BcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrW...v..........c./..q/.A."....>f<P...+

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021VL_KMS_Client_AE-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26047
Entropy (8bit):	6.717111981895654
Encrypted:	false
SSDEEP:	384:L9oSOCtZvkSQZiV3G6atvFV89SdhlhV0e+5EuaZE4Mn4l6ntilaW7C5S9qUdzQEY:UCnWk6t89khVPohc19n/dby
MD5:	A9BF3D88A9AE8CCEF077C67F1C8F0F31
SHA1:	0295BBA2986A8073F8F42C554FFDC2E653A354F8
SHA-256:	C0AE3F9E43D9D6C5B259C8A6D33CB4C8D48072D2CE7730B9C79848FF6E5DF01F
SHA-512:	460FC69B2337AF441EEAB961DB2427D5FEDE909B43F21F450F2C05C1E3CB870F6F4BD9B96FB49D7B79EC204DD32DE4BD328C00321DBEFE65C9E5F2241C8A3886
Malicious:	false
Preview:	FBm.n....V.1.w.p1?..<.....G.....OR...,.cU...?..G..~JaOe..P.&:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{998e9666-c583-b460-12df-31c3280b8de4}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x...k..I.U.-.s.{k'...y......_..7.eRo...C.yA...".....zPf.-..R.?.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office76881159-155C-43E0-9DB7-2D70A....e..T.p.c.w.{bn..l...........G.....*.)I..Wm..]..{@,.'....-15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X...~..[...}.{.wxt...z.............PU..}.:K...7....=`@88..h.z/TM/v2" value="Office21ProjectPro2021VL_KMS_Client_AE"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:s....%..N...4.0.woo...x......{"...eM...f.{....k.....{PkK%....;l:priority><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-...\|..L......D/M+..'......S...Y.N..

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021VL_KMS_Client_AE-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11985
Entropy (8bit):	7.079610835945283
Encrypted:	false
SSDEEP:	192:Iu0487wTqccG2U/TNniqxLoxdj04ntBivJ/FpJD:Iu30Iq0r/Zo/jrP8J/9D
MD5:	A9EDEB880136E6EE970A4484DFF7A33D
SHA1:	20027E4EADA9E3D28A79BEEC7E44EBE39B12BBC3
SHA-256:	03E6F06A4CFF4EF1DF7FD10A044AC67F4015FA91E04E332F13D6EC61A2FF1B0F
SHA-512:	476535B6AC5902259168027CEADAD3E7B6D804AF1C3FC5121B1EFE8C5EBEC70103CFD5F8E6D13988AB2C1D715C1672672E27FAB0FC233FF59AA10D50DEAEC73D
Malicious:	false
Preview:	..N.ZQ.W.{i...=Z..}.q..'.......j...w?.+.p...g./.....sO...8..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{08c54d42-5cbb-4c25-b787-?.W...R..EW0gM..m...w..)..:.......s...y;.i.y.../....1.M<.2.;..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/Mvx.).zq..1D5...>D..9..x.I....../...'n.y.#...q.\|.....j...J$..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21ProjectPro2021VL_KMS_ClilJA.0..`...3{...l=..?..g..&....l..ts.?.8...".=....>M.b.?..><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://w~S..B.XO..W9*_..9W..!..}.Tj......g...-?.......q.0.T..k..].8..N1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRzug.4.bO.{6FS[..+:.....Y.5.......&.../

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021VL_KMS_Client_AE-ul.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9974
Entropy (8bit):	7.108514182081109
Encrypted:	false
SSDEEP:	192:dFHz+nI85FpucACkgJUPyn1fG7ttF8xJ1hf:dlzh8xu0Jh1fH
MD5:	583E2903D41CB39B584EF8C5CCC318F6
SHA1:	2A15AA08D84C4E639AAF2DCA45E2A30CF035D1B0
SHA-256:	E8653468A916B0FC1A2E4A1D27BB7945FD65BFE608D2B3A90CC145C71C5655B2
SHA-512:	489C6F3E3E99DB307351CFD526F963035E1CE7036FDBEBEF0269721D599BB7FB47CCC8769CC136A43F8186431291408328CCA3DA14594412EFA831F6FEBD7057
Malicious:	false
Preview:	....4.w7 k2...m....N.1......^.\|..;m...f...Y.....2U.aT8.g...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4e28db5a-326d-4a06-a5bc-{Y0^9.q a7%.._.=.]...iZ.....3...+c...1.........b._'b.s..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/\m..S..W%yZ...M.n......8........;...9$...l..S....]`..d.,.h...r:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21ProjectPro2021VL_KMS_[S:Ze..ZRtS\|..E.>..B...&....._.{....X>...s...H....N!H.p.%.)..id"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http:7.$H\|.0(99\|'..O.`......8....._.Z..O3...?...^.....,{.'...h..n1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr(N.LZ.+^o.\|...0.d............P.L..A.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021VL_MAK_AE1-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10987
Entropy (8bit):	7.117550485501823
Encrypted:	false
SSDEEP:	192:bpkL7avXCtznCBtg3VAsH5UqTwLBEP/hw6Eeo:yQXCtznMu3VAsLTwLeaeo
MD5:	DEA8F596A84DC7EF5430D98311AA161B
SHA1:	196682702469A36F10CC3D10A804646942C33A0A
SHA-256:	847D7F1B0C09AA466620219A5DE6C028FEB9E37023FBF3CBFD83658667DEF95B
SHA-512:	DE121C7FBDB6D7EB43EB183948455B6E6DAFFB2249D9ACF41986AC71C9B4F86CE8EE35F25C1513FF61AA36EC7F32E0004C9CC00FAB64ABD7786B323369D29A94
Malicious:	false
Preview:	2.I.2.-..m..i...'..a.D.^.v.z...+Z...-.J.I~~5.d...1X..J..h[yrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{3e564ecb-36cb-454b-806f-....4.qX....g.M.w.D<..I..`.p..9s...e.Z..)wc.6......oK.9...kD-s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/....U.. .4..5._.$.Xu..EW.+9x..sX..P.....Sp>.K...&.N....e../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ....l.%Q.y..~...8..`.\WT.T.r..;,...o.....k~0.a.....:a......kD-s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b.7.k.x.....J...5.m...PO.^.[..'D6..M.C....W!n.0...'UV.....KY.PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4....f.&.....x.7.M.}`.<.K.C.)..\|eK...p.[.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021VL_MAK_AE1-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25983
Entropy (8bit):	6.585449682674141
Encrypted:	false
SSDEEP:	384:3ciHpMJ4yV8MWE8ExrC+nJveeMS+JVEkhF4rHicWW3lk6L7nHdTmKsb3gV0:X3pEtZJoJV5yimv7HVTsTge
MD5:	C66F8B51DD86DEEA9BB892B80A908219
SHA1:	D9A14A71101F7DC93A8A71C09A8F3ED0147A4CFD
SHA-256:	5F3A164D802760156E4324E0C1317E211184FCECE1A150A6982028DEE8FA826E
SHA-512:	72109FC19A3FEFC1B92D8993C83591B8D6D4668991F85B16D92592E202DEDE50F0058D9F598774D39ACBEE9D168AFEB5C3C2F3A5BAD7560745DE0E7A88DCBAC8
Malicious:	false
Preview:	Q...K...9V..X...5;..z#....u'.l3`..v$cc.O.2..E.....&g/.3y[....x:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{008a9841-7806-9075-1c77-73676daea810}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.+.NN..{.:A..\`.A-g\.?1...!}.;?o7.\$...?.b..A....j"`.)~.....a.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office17739068-86C4-4924-8633-1E529....1.?fg.w.Xs.Hdo..9....tp.y4%..~}e}...!..e.....<x7.94.....s15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X....[.1iA}...Tt.R~eB.<#....bs.cz6..?&,6._.)..C.....ep/..X,...$/TM/v2" value="Office21ProjectPro2021VL_MAK_AE1"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="htt.}.....hZ&P..B..R9iC.wG....c..9!.).f;y....z..E.....8-r.a%......yrity><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4A15-4....L.Nv.~r...(../O..z=...}t.db+..Yg/..

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021VL_MAK_AE1-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11956
Entropy (8bit):	7.115250104793902
Encrypted:	false
SSDEEP:	192:+bjVDiI8ttUTUwYImQXDtwDKLp188k+rPuAqOHW1+zgS71Jx:+bjVe/tEVTieV18zguQ21efx
MD5:	42ECE20CE0CD01896924727800CCD411
SHA1:	58D191253CE5B64D5FE9390A095EC5C869113E8B
SHA-256:	14CB0AC1631195211E58873B31B3954FA44995018B2629554C37E6CA86C96316
SHA-512:	8DC30FEA2DE534FBFF5DFB78E7FD74133D97CAF1A6E7395FCB20C924AB39E2E10184C6B19CB6ADBE26250B08E36E92504721149826B705203DEF9A3698DA830F
Malicious:	false
Preview:	..et.....*Cf...+.AL...........D".Y.Q0A...iu.....>.!.; .? .s..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{7ccbcbe2-5fed-4a7d-a73e-'\|.x.....d.q.O.=...]............m.O.. O...>\|.......K..x.Lz.g...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...g}....srY...g._...........Fe...%2..P.B&.....m.6.69.\|q.0..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21ProjectPro2021VL_MAK_AE1a..gWQ...1JQ... ...A........Xk....`?.^.x......p...$<.=f.m...opertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.,>.g.[...l.;...!...............2....v..G.0#....%.1.>;.m..~..z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlEx.>..v$...e.V._."...l...........60...FDG

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021VL_MAK_AE1-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20300
Entropy (8bit):	7.204211914887024
Encrypted:	false
SSDEEP:	384:F2CokL7XwT3W3vyljiR4l8xSwyjyIwiXQUZyKXy:ZYDSylGi8pCyLwLy
MD5:	067E8BEB5953EA19271C0555A9C03453
SHA1:	D77C80A458406F808A3B7F2C93A414AAD5E301C6
SHA-256:	21225B62D7C4B63B234C98F7A80398EB46847BBC0A910B0F3B79B2A4A8763E44
SHA-512:	909D14A056F9F9ABB5D712032FC994E8123526208FD1AF94D4C3F123BDD8E5242C048C58DDD7471F29F08416F89D80C3DAB31A82C56AA58435CC853502089A7B
Malicious:	false
Preview:	..?+....3<5#..u..r. .......Q=.lU.R...4!.....\|.:.\...y...&Q..hrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e8ae1e04-39a7-447e-8a3b-.P.q..v}20..:.E<.}...Q...[n.{....R.$/.....L....u...!.i.kE..<s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.4.8....!e....(..l.4C.....S2.h.....b.6n.....\|.:.\...y.V.(.S. :title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21ProjectPro2021VL_MAK_A/W.J..r$.<..b.Z5.}^..R...2.y).K..E.pq......m.5.\...\|.S.i.S.hpropertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.wYH.e....#z.a..b.D4.gP..R...t..r>.K...[q.....^.b.a...C.T.9s^..y6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRl/..e....Z~dh..h.y7.CT..?...x..30.e.m.l1

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021VL_MAK_AE2-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10987
Entropy (8bit):	7.143388243811732
Encrypted:	false
SSDEEP:	192:xXv6eFH4RM/kAZaQB+J/L0OK+yB/5Q9LJ4bDf7h3o2AtYKGD:ByC4+kOBs/LHVyA6f7h37QGD
MD5:	9F1FB7EC3643A8E6BD9C0AE325F2C34D
SHA1:	E45FF6D8444584DC7F9DFC4F3CF99E982261D9A0
SHA-256:	249FA7F5D52E6CD9913418E1622B6B73FC4679B3F4BC05BC52FC037A1764A1C0
SHA-512:	A2EA639E80888DA0373476E83353E73C28CE58E9E18B85B2AD8178FBBF664042B4AB4B95BF16C71A3DF854C4599972DFF30F8E9DB2A948046BA3CF520DE4A1D0
Malicious:	false
Preview:	q.@RI...$.....Z..j.l._<.l.:./h.e.?..y...^.v1}2...t.x`.c.>...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{7bc95807-54de-4ea0-8cc9-........g.....L..7.=..p.q.i.80..\|.w..w..... h/z...U. ^.9....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..A....6.........~.'.V7@L.5.+0.. .B.....P.}xR>...c.%@.y.;.R./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .. ....&...S..k.t.U ?o.m.:o..h.}..#..K.s6x8.....l\|.~.*...s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b...?....4....z....,.N.5m.9.&...t._.....w.-.)/...b.=(.T.+...PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4..^....R.....V..k...J.(e.'.}&. .b..i

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021VL_MAK_AE2-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25983
Entropy (8bit):	6.650462299575871
Encrypted:	false
SSDEEP:	384:XoH2Z+Ie1400M0rzGQUNHfCOfF3neek8V9DQhtUOEWyhaRp+HemRPmZg6sJ5N:YW4GFdwpF3HItVVRs9PyjC
MD5:	ABCF8A841B5D73CA025666F15FBBA583
SHA1:	4846F63909211791F32949CDAF66459674859B6D
SHA-256:	044DA1147654DBA32164FFF408D507E72C65F261A16DD48ABEE4BE23DA5CC1DD
SHA-512:	BF4679348E53C1851C506433882C5757E2DC2F994ADA612170F62E93E79AA6453C3767FAB474CCF35F148414569D12A816AE9A78589DAB428D7BE54C3A18CCA1
Malicious:	false
Preview:	F..F.....pS7C.v.`14q..m....>..2../>:J.j..T.(...=b.^.k,$b..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{1383344c-670f-a1b0-6287-fb4327b02edf}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.YV......gO~G.}.xmj$[.9._..j....(.ZD(:.:..P.#...q'.Z.!d6o,..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office1D826E94-0C6F-438C-8361-33400...O.....Q..C.}.1e&nN.\|....l...'.O) v..y..t.s...'}.[..*n.&j.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.xtH.....7.xO.q.+ot.X.p....r...\|K.`krZ.q..R."..~u.....qA2.../TM/v2" value="Office21ProjectPro2021VL_MAK_AE2"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="htt...U......vS+Y.~.lcu,..Z.B........i..5"9.."..T.?...#(...."2#0)..rity><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4A15-4...W....T.q..!.zE....9.B.. ...?-Uc"9

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021VL_MAK_AE2-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	11956
Entropy (8bit):	7.06553192842995
Encrypted:	false
SSDEEP:	192:cdMqqYhv6+Fjn++tIIsiK2+imbAIJM1EpaVJMEk+SEJkvg:cdMqrhvzxn+TIfKjsI21EpalkrEJkvg
MD5:	ADC1B4CA89C0204CC228FB67546FB494
SHA1:	45FCE2E3EB942D447C1DED49A980C7888AA1C779
SHA-256:	1624AB2DB71C5B3B79FEF8078A905F8FB8FC5D2EBC79CE988E24E9ED2A4E609F
SHA-512:	36F8A2A48BA3E33CAA185CE96B63B61A20532220D1CA6E4BEF32D0C88DCA921D3B462B265B2EBA4F7236FD101D9EE80D8DF6868CE68A368B7FF3AE9673E572A3
Malicious:	false
Preview:	..........z..2..AT..M.....H..J.]...2......b..9.oJ..I.).y.~9cL.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{5c6ce1b7-4a33-46ea-9c9b-C........(N.y.....LGH.T.U..I..N..zF...CkJAk.S\|)xh.q!..3-`S.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/>.\|.g....K6.-..BJ...R....h..M.....Jm....?1..4.d.M.N.0.:./z...itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21ProjectPro2021VL_MAK_AE2X...M.....s>.+.....P......A..e......yN....9.?;.d.G4K.5.{./'7O.opertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3...V......&T.6......_...%.l..r..\...RN...M41.l.YQ..t.2^+."4DF.z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlEx/.frl....49.i..3;.}0h..3.e .\|."y...e...

C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2021VL_MAK_AE2-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20300
Entropy (8bit):	7.21648985954874
Encrypted:	false
SSDEEP:	384:oReezWiaijJEyoI8v143XY6Y1Sxvgy8SIvVqnQ:qLl9GyoI8K3ZySxYy8RUQ
MD5:	59322E9441855480DFB4C1B09ABEAA22
SHA1:	19022B47582EC9049D139E047DB59D2FB02C7D5F
SHA-256:	A34E2E8430128E8ADD374B39BBD29910E59D681C8F77C2B7B305231C6596842C
SHA-512:	2C8A575780B32F2DF4445AB45049050945B8480F534597F7B7788FDBFEC83102D173405C1E81F59C49A94104419AEFAA5A6636C6AFD436B389288E9301A5A792
Malicious:	false
Preview:	T..[OF..@..,.v.d..y...L.f....1.!....g.-..$a..P.v[I.R....W.j).F.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{3ee8e43e-b6fa-4035-b8a9-..YQCZ.Y..g.=.r..&..G*..M.&.d...8.#.f6...>g..8....$.'=.Y.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.%-H(L..RP...i.(..:.....m....5.#......b..8c..P.v[I.5.....dl...:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21ProjectPro2021VL_MAK_A.EB:L......3.Z.z..;...D4.....$.o....e.}..:j..X.]TW.(.....%{.G.propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w.Y......PO.n.0.g..;...ND4..<./.b....c.}..:s..U.z.M.}......u..T.y6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRl..5.'d..)K.g.].8.....!);...5.n.@....l.=

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11503
Entropy (8bit):	7.092258242481003
Encrypted:	false
SSDEEP:	96:Xm9/rJ640rdgRE3BRrZmKS+ONWqJFePMrAaMmCqOwxgYjiRKN2Y6RA80f8xqT3dM:0N6QmXlN9f029SgNO25J0kx8tCt0leZV
MD5:	EDA0A3A732EE1827F64AFEE96A8123D4
SHA1:	528B212557F4C2E3998D039075B15897E71C6F1E
SHA-256:	7EA9E363ED53C7D9F975DE1003F807734414FC343A565175D984B01311EAAECB
SHA-512:	625ECDD4B7CEA25492239010F132D7EB63C66CFAEE1F0010562E00D4152113DA2E8282349C4E83CFD005897C7FCD5E093AE26DE9784688CA0C6CE213995DA190
Malicious:	false
Preview:	/].2.....v..S..q.5v.........-v...)..b.:"lT;....-...:.:S....e..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{644985c9-fbe3-4a50-b3df-..7K....0..].g.{)..WL....a...0.=.4&b.l..T.e...P........f.Ls:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...!p..../.....=.+5...[....*r..k../^iu#N5..D.!.....u......h../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ...@I....b..D..x.){..I.......c../.6.s}"h=..Y.<...?.&C.......LgPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200..7....@s....#.D....y.......~...(../FAz.....=.g.....2J.....?.SrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV...}P...U2..f..x.<...U6....(H...r....i

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26010
Entropy (8bit):	6.637044717572848
Encrypted:	false
SSDEEP:	384:dyAC8upB5FOcdKbURFhOurAIxg0XgnXyeenZ42TPET+o65hHNW+OoL0BVnf766vC:0l/5FJThOea0QO8uz47pg4vbI
MD5:	F5F61BCDA76D4DCDD267F20BC1D26691
SHA1:	FB7C5DA0C66E0FC3BB39202349A8A147E0867DDC
SHA-256:	F7426C46C51AFA733A25772984B3433B370EE7DA9F7DA368B89D57D93091EC14
SHA-512:	21CBE3FC454C15D788FC742424EC85B632779ABA1238A2C6C3AEFF5B586D40F8FCAE85DBB79330FEA49BFEB19A6B368D1E80DCCD8A0C72ABFE61191A8918E8A9
Malicious:	false
Preview:	.=w.Q...:.".Ike...tQ..u..jR.q.K.....\|..wj/..p.j.LC..AJOQ..'.n:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{335fdf1e-f617-58dc-e848-d53bd4c2a918}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x&..D...9.>.Mtn...*.O.!.G5..%.G.........:5....wLZ...[M....%.w.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeAE1310F8-2F53-4994-93A3-C6150y.........3p.Ign...fNZ.d..iS.#.L...B.bB.qye..w.8.EY..K....Gc.e15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X9..}..~Un.E`b...4(L.h..kE.=........)F.&qv..`.b.....kk8..S..2/TM/v2" value="Office16ProjectProCO365R_SubTest"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="htt;....^.%.".Skm..5..fB.Z]D.S.Y......`..'"e..\|.m.P]......O.Q .ority><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4A15-4....k...}6f..<2...n$..!.ZvZ.o......X.`.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11952
Entropy (8bit):	7.062911292976264
Encrypted:	false
SSDEEP:	192:pl22DXuK+0Oniu8XBlQ5mVGtsqn9TlxBH7+dKjYtWA:ps2DXuugiNX/YYGCYRBb+Qs0A
MD5:	FDCCD5447DEC1708975B0661E7F2C7DF
SHA1:	23ADBB8716A6714ED69B1D6B760840397495D880
SHA-256:	D67E459BAA4C2202FC3813BD05DECB7417993D92570E8C9CD9F115FFFA80CEF6
SHA-512:	E41BA5F7A296A780AE08372C5237053BCFCCA9E5319575FEF8E0697A27F984A84403F3F3640A6B475064D43E4ECFB22A0D9CDB60DE22F7BDA43A74CFF61CA229
Malicious:	false
Preview:	......0."..I..1.h;.eFw....k&\So..^.WEe.....w..:~.(-..A...n)..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f7fb25a5-5188-4314-bc66-..w...m.`..]..~.8u.8L&.YG.v,.Px...A.:....~..rB2.G......cz*.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/g...y...0..v..l.k%.q.<....K$STk.....=......$..,uWe:..X....-5..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProjectProCO365R_SubTest..z.S.<.Z..~.,.&j.$.k.K..b-G\|d......2....,...2uJo...]....p}.opertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.L.!...m.-...2.&p.hTk.66.O'Lki..N..%2...!...(H..=..Z.rc...z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExv...r...6.y.....T..;.." .F..eK.L...r..

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11507
Entropy (8bit):	7.080614489797972
Encrypted:	false
SSDEEP:	192:W28Kw7sZzbfE7b/Iq9lrsKITN8SIKPLaF9hP8kC+3+7fDvthHm:W2M72/fE7LIWeKIJ83tT18kDsfDjG
MD5:	8FC011FE4FF462D875121E6B2DE90923
SHA1:	AB5EAD9B7A1ECED70A8472A38CD58347E6ACE8E3
SHA-256:	00E478348383E85FD6273EBABDE16386BE9EF9FC053806138CE3A9723F849DE5
SHA-512:	5DE56D4FA6A76E337BC50306723BC677E3B6C5BB9B7F5CE3F2B7B639D2795BC8423BBE8E35A22560E00CDEF692B924634D2D84B647EADD59A6B1B2FF8E8AC839
Malicious:	false
Preview:	s.k.E.F..c.0...9.`6e...a.X..pS........Jp..}..V..E...\O..r.xfrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{3993ad1b-6d13-4f62-868b-.F....I.."+'.../..i8....-.E..sD.TP...E.$N~.t....-.l....b<.f.g2s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.v..".f..:N....u.~uq...jUx..wW..[...W.y.?..)..Z..N...\|...w."`/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .E....N..ws,...0.\|;d...}[.."F.U....N.c.>....G..E...H)....b2gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200....U.F..fs%...k..F.....c.RK.S[.F...W.Q....4.....T...h...i.I-rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV......n..'^/...0.iP....h.~A.um..:...l.y

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26011
Entropy (8bit):	6.6356245195477825
Encrypted:	false
SSDEEP:	384:pDCH9zfM6LEhrfBw5hCGxyJK5xvX4vSeeapkwefaSLYk6EhekWiztQLcLLjVoVvI:UdwhrfBw5ly8phaSWkK2M1xw
MD5:	90E5F44C0F8208EC6934832A150C4819
SHA1:	B4C74E14D4740B480D876BF610629BF7464E5B2C
SHA-256:	BEE985AFCA93DBBDC04BFD9D2EAB8A69FD0D1C5F27E15555E00898804A885C48
SHA-512:	004F566BB9D30AF16E8DABC4D86A4EC1DCB0D1F808E54F465E2B1F7A00348FBBC530F159B48987EF33EA5533C6FAE159C6A3D29FC81E3FD6E3C6724DA970DB73
Malicious:	false
Preview:	.=3K.zcZ.-t..!.JbcK.nm>....2.]Mv..RZ.+.`...C.,...KR^]..0...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{17256eb1-a56e-e6ea-355b-d36cf732b8ca}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xa....ov..:h...R>=...:9o...>.z\|\.q(H.D.z...H.e...OHY...=....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office2B456DC8-145A-4D2D-9C72-703D1O.4.2K....&....6qT...j)....5.ZX~&.L..-......,....NX....t...15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X~..E.VC...j8..&..<#2..sn1....{.X.?}K...z.9...I.+.....x...`..[/TM/v2" value="Office16ProjectProCO365R_SubTrial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="htx..X.uyA.!e.. ..}....OQ.....=.{u?$.R[.d.`...I.6......H..(...ority><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4A15-8..O.:L...yG...w._k.O..52a....`.AZi.R.[

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11957
Entropy (8bit):	7.071002268546694
Encrypted:	false
SSDEEP:	192:FwH+UufMF4a4gsYtkNa2WUibdKlL/n69iI/PlA:GH+g4ftAkNrW1bdgMdA
MD5:	8BCD367E8BB90849E610387AE77A6118
SHA1:	BBF798FA09AEE90706DE2F2E30E345B759F237A0
SHA-256:	6996C3FF269DD395D9F013FBCEC4B52584A36B55AB0BC5316CEB28C7A965A19D
SHA-512:	918DD065857C42AD30ACEB306F572F4364B1EB73CE60FA7A6903C6790A5BB6DDD0EF442AE2CB373F0461ACD3B7B489F4741A4C65A958E980977565BD1D029222
Malicious:	false
Preview:	.H..:.Z,..lK...nDWV.$.U>..df.o....l!?.L...d........v.D....,.!.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{2a6aac7a-0228-4472-9011-.~.7..v.m...x.....G.f..yl.l..Du7w.\...&...].6_.e/.9...8.>.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..P.].z..]t."GI..`].7.Dd.h...O.gG.N..6......S;.C......o.h.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProjectProCO365R_SubTria..@...!..dU...r....{ZKg..1d.s..@$5(....z.........W......\|.h.ropertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.o...p.9...l....7.Kg..JI.x...}y.....c.....F.+{.a8.....q...6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlE..o._.x..0....Q.:*.Vy&h..F@.9......!.A.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11523
Entropy (8bit):	7.08561906016609
Encrypted:	false
SSDEEP:	192:N0p4Be9HmLdczLKkLYYMV1FvBx9Y6ndhKi5:N0p4g9HGWfLRM1Z/YeKi5
MD5:	BA364A69E6F6FB77B0A0D6A41FF42746
SHA1:	D2562B5EC544FECDF69B6F3E16F2A60C53EDEA43
SHA-256:	DA7660E256A821E7AFEE41CCF8C23E64D841A37291BBCD8A7AD2100ED3F8886A
SHA-512:	0CC05435752E81BB6FCA661C169ED51E42DDFCE52ED2CC01AF1026067ACC77F58A1985C94B9A7BEBB0A9BFD5D55BEE8157403F81529B466D4464A4E824EE97E0
Malicious:	false
Preview:	......i.)X..B.n...c.......gH~B<.q.~........V......^....D@.0.\.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{db644ac8-f789-4e83-905a-X{N..4.m...LC!...<Z..H.N.zB-A+X4.g.f......_.R.4.w....7..$.C.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/$Ob...I.;.....3.. .W.D...GJqE8Xs.<.S...^....B....U.....Z.5.../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .\|]..a.+L..U.o...n.Q.V...d@).).5.x.o...V...._....^...."T.=.F.gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200P2....i.m]...C?....bF.f...m.+a4Y&...=...Q.....;.3.O.....K.+Bm.rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV.-_..A.x...w.0....cT.J...A.fG.\|d.%.b...

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26575
Entropy (8bit):	6.641501012224918
Encrypted:	false
SSDEEP:	384:JWlLwy347Srif3m9gPau3qhUqhNxtj1eerO+b0s+PYrnHr0DFShFWCzjFc34MM9/:gu/P3tlCU0DtGfYjHKFpI/JBUA
MD5:	12D627C97AEBA7FBC3FD4D7FDAACBACB
SHA1:	E4D6171B85AC56CFF232E7A745F00409A666EA10
SHA-256:	7F3785AB7FA950B2FC99CEBB00D6B04E67E050E277E7A497C36E644D09C63606
SHA-512:	659790FD596FFFF5DDB713384681008A4B657FD972FFC86353CC8725419E86E38C33867D76CE7DB938E65EDB28247FA951DFDF823007D658FBF2613965EF4525
Malicious:	false
Preview:	..`......_1$J.v......}..ClO..P.1...C..m.Z.....&kAe...D..eqs:'..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b03d63b9-54e1-9a66-1f75-ec61c17ff49d}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.......M.\&8..i......8...=...[=.=.i...*.Y....-v.s...@../9a7%...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office4031E9F3-E451-4E18-BEDD-91CAALC..N.P.y.vu.z..H..-..D{L....6...K..s.......}9Al...A..$3(~c..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.8...#._..vh..}..R...;..@cN....x.....8.J.....,cF........,.j.../TM/v2" value="Office16ProjectProCO365R_Subscription"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:slBW....._.^#!..p..T...+..Bb...sDT.".......Y....yu@i...\..m3~$}..:priority><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4>D.1.H...d..(;....h...J...D..U.J..,.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11973
Entropy (8bit):	7.059559988659587
Encrypted:	false
SSDEEP:	192:m+5w2MK15iChaoY6CQ5OSyS6rhsfPygB47+XRMisMkEnZv2Y:hG2niCh9Y6CQ5OSUhUh4ahMNMDZn
MD5:	04045A5DC504A68865FB5E8D5C910CEE
SHA1:	6134520813CA8D875D2CE4EC58BA9FE947AFA5CD
SHA-256:	FE436469C2147D8FB606320013E1C3E286337679535D52503DCB501D40777CC7
SHA-512:	FC2B3F213BCC31848D8BD637A82B09150A06E92AEA27516D598BDA044B586A987EB60D2A13CF74FBB19C82293F9B7284D2AFA4BCBDC93C6C469F89541D7ACE29
Malicious:	false
Preview:	%.....F...~..A=..a...b.,..U.]h2.A..m.T.3.xa..._n.....C...carg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{802c903e-a139-4b8a-baeb-..].......(....WmJ <...:.:....J0w..W...c.Z.d..8...iG..H.<.....\|5s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..u...f..MO...>.<u.4.k.q..Z.Y00......=^....wm....#..r.......*/itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProjectProCO365R_Subscri..Q.v...!..CE^>=...n.!.....3..K... ...&.xd...^E.u.P.K..2e<r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://ww..O...Y..P+...../^##...`.m..n.{.u.F..l.%.0.x}..mb..H...t..\b.1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRs..T..Y.m1T....BT\|....d....z.w.C..d...

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	25749
Entropy (8bit):	6.6197674227287875
Encrypted:	false
SSDEEP:	384:OBBVf/y4/XpNGP5vtCNu3KiM2ctePcqFCXnWH/7lU2DoWoxFqAQvOgj:4F/PsNtSbN2cGNH/m2DZ0jY
MD5:	DA3C932BEE9AF8F7482FB736B9F54E2A
SHA1:	067D2CAFA7A5EFA1152E48392349BEBCA5EF4DDB
SHA-256:	B7C7EB19D3A27515C5A16F9024EF032B45FB3F933F2046987812361D9DCC0D4E
SHA-512:	F4F640DB9060AEDA3D88D9620F4A1756A01AFB1826D63BB39A9CBF65F0A5CEE7A7823DC22A2EF7C82D83216008487730430FB41D137F9796AE6C222632D0460E
Malicious:	false
Preview:	......;n...GI.hK..........r.>.."O.u.......E.:..!.s....Fp..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{0d81ef50-7c1f-e302-a538-51924c9064f5}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.]e....V9m..CCV..p.......PH.&.2....O.....S...J.'...dRw..\..Kr...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office13104647-EE01-4016-AFAF-BBA56N.:....KKH3.5GE..9......... .9.?..k...../B@h..>.v.FW...4..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.\|G..DmU.EKB..#..........>.w.dkM. .....U.2...6.0.a...H4./TM/v2" value="Office16ProjectProDemoR_BypassTrial180"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:s..)....Q47....K..8.......W.N.,...P.....C..ZU.n..6.v.....T9W.l:priority><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-Np:...S#5O.K....\|O......%Z.-.,.d4..>.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11976
Entropy (8bit):	7.018080011215292
Encrypted:	false
SSDEEP:	192:BVaEhMZeFLr5nQAfvWyYb6TlRuML69jw8PdqnFwzC61tazyd9i7:BgEqZAtnfvXYb6B4Qcc8PWFk1O7
MD5:	78AAE6F29396E8DBDAA374D6CE834ED5
SHA1:	266B2D2939EDEE4018A980959E569B39E1159880
SHA-256:	EED6C63EEB737A52759646746640E8F5FB0D86FD69834D056A2BCE5B8E8EAD59
SHA-512:	4CCB8DA227B6C096E16A4ECFCDA34CF48E4008D8D49BFE8C0A0BDEDAF090D8FC971A2A52592CCF87AC04043EDF43808FE60A976EF316C5E9FBC4FE2B73570F07
Malicious:	false
Preview:	;...1i..lM]u...v.d.M~.h..F....;.ss..-Uu..)e."...MU. 87.)...\.G.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b24b34d9-4b84-4010-a6f5-.%..lp..-Y.4.B`.*..t..0..[....c.<j..rE{.k2.tFT.qc.J.......H.X.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.Ae.Vc.2~.lJ..P:.z.Y:..a..f....c.71..YW%..{N]-...F..7?:.0......itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProjectProDemoR_BypassTr.rD.6!.#p.J=..:u....<..~..G.._.<.iu..yIv..=mF....UG.)+5.d...@.P.><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://w.d..=?..+..7..M(.i.."..d....".G.c~..y./...mP;....J..\|/.1...Z...N1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qR.Bz.Ki...akH.V!...Q...@..d..6.K.U?..W'-

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10979
Entropy (8bit):	7.155415771831193
Encrypted:	false
SSDEEP:	192:W7e9Hg8vfTrZqy2LjxhpN+3JbXqa+zFWk:W7QHHvb9lK9hnsbXqVzFWk
MD5:	10802226FB25EE25851EE809982E2917
SHA1:	A1F1B4723CB2816FE00B9B31480A9D6F6EC71EA7
SHA-256:	5C13BEBA0AF6C1319C282D758B496AF684597842B35F664080D95E481B471500
SHA-512:	B9D9D69901149FCE6251791910475B9998C376514671AF8E8411DD139943973A2183DA22CCD8F6F773EFB2861709CCF110310839942354FAA7C23500564E32AE
Malicious:	false
Preview:	bc....Py./...G".A.7gUf....z/......au.ek...l....c..X..?....s.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{ee697d0f-7741-412d-8149-.......,.a....m...h:_7[...g%.....)*.ko.N.e...._".2........lRs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...r.pY.v...X..B.ts.-W...Z-.....P.8U6<...8...n..l........)./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ...K.X(.;...G#.^.:f.~E...y'.......8#!S?'.B.l....3[.z..#.....lRs="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b..L..}.l.Z=.S.A.R&B...{.........u....G.3...N..U...w.....qmPKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4...A.[q.l......+.QfV.....s\|....$<=.u

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25830
Entropy (8bit):	6.6781514361435494
Encrypted:	false
SSDEEP:	384:LfMEItZhcf9pIBr3Ox5gZHjf/GeU55mPg7fA76o9ghpj11WyG42XzVxMPcTWizuI:Uw4Br+xqZHjuDzockc0T
MD5:	6377487FE0997E90FE2F52A7CB1AE322
SHA1:	3824D2A1EA98AF1CDC1A7D4238E8A7B6FCFD2106
SHA-256:	231FD525B579DC15C1281F8AE032B9BBDA027AFB7ABC4D8ACB928F6440E5E9DC
SHA-512:	F8B1C892AF0982A1D8D28C779203748E345656F7427315B14073F5E1ADAB6A77BB91DACF3AE4608F3DDD09EDF740F3B505300F18759D6286892413C2FFF9F3A6
Malicious:	false
Preview:	=-.f.{....s'..6...J....7..8D..}..^...9.s^..'..w.Y...-.\.8.d...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{127d15da-cf8a-3710-cf7a-4f6cb4041685}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x...).n.\..d;..)...LCJ.cC..l.H.q...t..+.....#..jAO.]).[.p.i....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office2CB19A15-BAB2-4FCB-ACEE-4BDE5..^j.BRA..Ru..:....._.&..9.N.z...V..u.uM....%.P...(...z. ..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.. h.WN..4k..=....RoI.../.P.4......q."E..!........n.}.e.4.../TM/v2" value="Office16ProjectProMSDNR_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:...-.-....y&..-.....b..}!....].........j.?^..<..`E...Cn.C.:./...ty><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4A15-4F8.T..3JP..#g..n...>....}...,B..#..L...j

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11931
Entropy (8bit):	7.067520526043766
Encrypted:	false
SSDEEP:	192:Yw0TSLG9yqoSLFckWRPyeW2ZXDxYB/P/g4cSWLXdVwfaY:Yw0TAqbn+P7JXDI6LtWb
MD5:	10071A498F371DBF3886C78A3690DFCA
SHA1:	4DEC6E1999F4FCDE94F8DF1E75FAD84778E3858D
SHA-256:	D4D875D890676030063879942E01C5D731F2794B0B19929A280E4E80067BBB63
SHA-512:	E75A3E599400294B28321E26C65C89DDB31F77947CAA726F885FE521168645BDC1EBD3011DAD4BF99ABB1DB295610EB4D962B47CD12576B6E7C6808A2FBF4CCA
Malicious:	false
Preview:	&(r..%..A`.W.+....`.....7?.8.k.8....l.4.V.{s..Ia5..NE#......rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8978c754-3ade-4b17-b86b-...@.i.WuIA.`...?....{).2.h.`k...$\$.R.9$.....]..eor{.......^s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...../..S9+h.4....#.V.<b.:.l.`,.[..w6^..)X.._jf..IH:.....MDitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProjectProMSDNR_Retail"].....3...S.U.'....?.....?3...i.9~...3zz]H.hf...-'.8UNt......@ertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.or.....m.X9.H.&....s.....9...i.`2. .%NzD..eU..Dl.."R.$........YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr..k.i..JT...%..............G.bV.....oU

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20275
Entropy (8bit):	7.19936578412282
Encrypted:	false
SSDEEP:	384:6RHad5IafymRMiSUlBW4ldfJqSYhyBhXTf8/JrGgPsvZfD:6MwGyVslMYOSxhXTf8/1uZfD
MD5:	E1FFF97B44DC031F0316AEE9DD7D0D2B
SHA1:	152C426F5C8A72AD560CDACE0BA33D5B054F9A27
SHA-256:	C15855537EB607B8DBDA631EFA2D46CEE6665A767B00DE00C8D870502C9240BC
SHA-512:	2178CBAB46791601E71F77CF894D08EFE77475463EC81E502681539701D9D178D552F48749283A95F4FF844E0D9DF0289536D6A4E8C1078FB8891AD621444169
Malicious:	false
Preview:	..j.....=....=..M%.....Ls{R.k8.6...#.B...n<\....i4O....R..hrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{58039197-9031-428d-97bb-.O......-...v..kX.....efX.h/.s.._\|.L.$.Ugjs.G..#..x.....F..<s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.)....../..."..N;D....G.[P.l<.4...oW...y..t.\.....np...... :title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProjectProMSDNR_Retailn&..Y..E....$...t_...PrY.D3....\t.<.z..5".^...MO6P....L.. opertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.#....S.2...9...nQ....qQ_S.S>.a..wt...c.[8......y.J...._..dz4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlEx.....,..)....f..?JU...g]Ve.]..D...@4.D

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11499
Entropy (8bit):	7.114314602227363
Encrypted:	false
SSDEEP:	192:6yRUtcDg1T3L3+OjA58lYC2euOewCiUBVm5yttDvB+VXsvZQ:l+cDq2i/f2HdiUHm5Eb+VX4ZQ
MD5:	C95E8EEDDD4DC21C2E03013861C53090
SHA1:	450CD1A90C950E1E41F7B424CA1ED2EDB0C69806
SHA-256:	D07068059F4136137C6F9688B5D2F64E17A56D8974DA5A45AA3CBC7DAEA803BD
SHA-512:	0D178C181FC89732F80BA4221BF0829A93A417F3A46B787821C5E8D0CEAB0FEEBA22FC6871899BA56D38F9C03C859E20C47763FE540DD830B0D31C53415B56E2
Malicious:	false
Preview:	...)N.zBA..s.o4...H....z.7%.....g.Z..............&.......;.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e6b6b44a-9a4c-4143-be49-#Y6..i..n.@..8.yd..EB...Q.g.d&.C....8.T...Y....].8r....^..$Js:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.8...#n.h.p<Bl.#7.........Z.8".C......J..........,.i.....a./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll 7.&..<F.xVM..s.f+.......y.`w.......3..B...........:.......!JgPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200qEd..)N.>GM.N8.=[..}......p.b..B....!E.>...._..7......2.@.UrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV2Z$..&f.+.`.+`.f1..\|....\./ .g......

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26089
Entropy (8bit):	6.717694236154056
Encrypted:	false
SSDEEP:	384:jqVlGcCKsDV+Ycrt6w+BPXN2xwE7VyQc5IfuOSB+OdgiqqmXwE30l9wrh1JW2Etk:9cJsAd+B92GwTS7QXj3Rrg2Mm
MD5:	2F35BEEDDAB3565611B144D78CAA5C31
SHA1:	1AB607672AE9D6DFC0A24C59C9F16323B5D0056D
SHA-256:	31526D36B9C3261F8D6D8B09D1E11E9507F6511D04A342A5DD1B2BB7D5CAE4C8
SHA-512:	401E50495A62102FD2EC330F181A8DF821609943BE20D0A53BB1048FC6FD9D9E03D274F61EF3DE3DFCB7DD6CDEA62AD4055C5B079DA13283273BD65AA2423596
Malicious:	false
Preview:	....d.u..~.y\.....y.c....[....w.@..;'...+..lY......f.E].vm.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{66d099e1-44e0-55f6-38fa-4be134081d25}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.}..a.`..i.0X..[..'U&.I........x.j.eA5....?..gDH.....a..O.th..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office539165C6-09E3-4F4B-9C29-EEC86.U).o.^.._.F\..R.k.3....Z....2.H..%k....7..7.......+....2\|.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.\#.t.U..9.6P..H.9y%....L...S!...._no....5..fQ......G..8.NS./TM/v2" value="Office16ProjectProO365R_SubTest"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http.>@.,.6...i.yZ....:...5..r.t......%k.......`C.......f....jp.ity><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4A15-4F.)B...(..-.8..........D......N6.H..%k

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11948
Entropy (8bit):	7.058131609564719
Encrypted:	false
SSDEEP:	192:cePGvwEVCn3ZOCxAjQiZhp/UCX6iQhXpeMHK:ceOLIOCrifp/n62MHK
MD5:	A45A897A2AE2E49D047497ADC6721B0B
SHA1:	9F782D9A816DAE52044E6013B4196606EF1A05AF
SHA-256:	99355E433E3A0CBBDE2C68CFDEE448A373677238DCD97AC04AADC63446C7949E
SHA-512:	93FFF05612798A0C4F1F842AAB44B65BDF621CA016847BFDA515266E44E0B06459729B5846ED5EB9D98548C7ED8DB49B0A00D632A4023757DEDED96685E56317
Malicious:	false
Preview:	..<=...!.....Mv......bp.8.T.v.E......^C.;.$Q.A._..p....)Whrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{a4240bf5-d3d8-48a9-a573-X0."4..J.d.....[&CVA.[.:<.72.W....\.........m.v..w.5..HNm...H<s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/)R.9Z.0.x..Z...u.J..A.k{..:.S............h.4.)G...H..i]..5.&itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProjectProO365R_SubTest"0<.d8..$.;.....P8FW\...u$...V.u.....e...ZE...*Q...h.."....7V=pertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.o.g.$2..S.n.....P"H.....T_. %.[.>......Q....H.>.0l.Q.W.Trp...>.(4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExU.W.EM..H.\|..G..l.Lz....BS..d.y..........

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11503
Entropy (8bit):	7.045444823739266
Encrypted:	false
SSDEEP:	192:Iy/FTVcT5vtQr7A0k2FNbbpqWRV26s3nDPPEml:TxVs3QrPkuNPYWX26s3LPZ
MD5:	20F8090F52F86A44E5C08E2655F8775B
SHA1:	57B5A89FF95022AB3338DE236046CD081B0A0E22
SHA-256:	9F386233E7DA9377DCA830AB84C621A60D79BF2E0BA52B40A5D23C1D21AE589C
SHA-512:	E7F7CCE46D1CC64686D63C84DF4D43ACDEFFFFA9AB7916B1F8C0BB6C3161CAE6A2487E9561E6317E5B46775D45386A2ACF196453BCFBC01725806E19D77D10D0
Malicious:	false
Preview:	....l.[...j3~....X....]...[..M.a-x.7....oX..>.M@..V.uae.a.<rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{ec65de78-a55e-41b7-98fb-;jk..q.UO..\|=5..UW................4n.h...=8Q.....d*.....;(.b.hs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.....f.{...Uoa........V.(.T....%o>.z.H..ea....3.Ft.... {d.l.:/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .=..y.....v$~....U...A......J.{+_.c.R..Ci.....9.ME..F..ug.{.hgPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200hsl..l.[I...c5..jh(....._........x,m.z.`..>_.....\o..O.$jD.;.wrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV+l,.c.B\..u.m....>....T...C..1.Dvg.A.H

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26090
Entropy (8bit):	6.692660787070407
Encrypted:	false
SSDEEP:	384:szwjzt++1IPK8qPp60GNjRwH2a4o+ic5+uEi15MSww3czbwFmIAPXjP/vKKWC1KZ:ssE+1lPpWFysgbqm5PL/8C1hHlm
MD5:	345817108A69A60005900F7CE7C950FD
SHA1:	116A8162BC4925C1A9D3D9597E07AA07F88ACF49
SHA-256:	C929B4ABDCF46BF2F2C96D201548CFB41D594665E044C10E15661A569D203180
SHA-512:	5814208C5D0A35E48945D7586B5515B3C61883345BDAE478B716CFA6C165632192173A7BC51FB822BEF057A76A0B817C252F180FABA70AF1B028FCE1A5209474
Malicious:	false
Preview:	%.Vi...PQat.k.I.,..0\ 2....ws.....R..D.X.M...b....?....;...x..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{70b911e7-c963-84dd-47af-25b2e6e2e3f5}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..&....Sbc.".V.v..n.e ..M[-'....5x..>.(....m....s...<....z...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office330A4ACE-9CC1-4AF5-8D36-8D068...a.Z..!GU.T.E..V."Cp(.... !..N..Z].Z...^...e....%....v...<..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..g.?...%3.$.B.eL.p%f2....#?..].J.....H.V...r..S\|..'....@../TM/v2" value="Office16ProjectProO365R_SubTrial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="htt...zE....~r.w.I.e..q.-V.%.SQ..z._B..X.......n...!.._g......rity><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4A15-4...x.)..\&P.-...&..*) ,....$m..@..}G.X.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11953
Entropy (8bit):	7.076885247083733
Encrypted:	false
SSDEEP:	192:7y1WhAZF2lmWuSB626P7Tt/oP8L9xcc1b5lO:wW7lKSBs7TVoE7B95Q
MD5:	9A999F27E1C816801A0F92B3DEC39CE3
SHA1:	DE4D03B70FA889485373828896A49C6A2F652CF3
SHA-256:	70A76B5FC84123E6002AE6D0FA907B17B2746BC217363A436800616EE5EBDFD6
SHA-512:	045DBCD03E4EBAEF28F23DD6E346D1FDC89E2EEF55F8FD65D1C1629C36BC9C138983B55D537776B97199BE46E1A95D2E77A858371E779C29AB40F77C1A48824C
Malicious:	false
Preview:	.........{........7....:X.xA..r...Z....C?.>0k...?.v.Bb~..&#rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{89c2aec5-2027-406d-b497-.<P.....)o.M...Q..=....,E.+B....k..JJ.....6.gb#.&.U.A..183..9ws:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/g.-......NDI......s...gx.wF....0.aXDA.hl.2=}.C.(.{..3/..omitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProjectProO365R_SubTrial..\.......vL....N..i....cQ.cn....t.B.jB.Rd..2c.^...i.@$/..%kopertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.L.....#&....T..%.....\|.hy....8.B.^B...i.>ey.../.s...T"..,/z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExv7....1K.]..p..J....u.)w...\....

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11519
Entropy (8bit):	7.0367543170071585
Encrypted:	false
SSDEEP:	192:5GRNMZoT3dKVC8wcraZHZp6IzQlU3LSdSh2LHVVQxN:sRNMZu3sw6qZz+DdMwHVS
MD5:	2B67C9E5975643AAE2ACBCCE23F0D87B
SHA1:	82F3D2B874AC98AC9F971BFB1D61874FA920F59D
SHA-256:	5F0512CEFEF67C3BCB28B8641C5BDE709E2CBBE269594FC9F4B29CB86287E70E
SHA-512:	1E7C21DE773AB95525076274F14A68B23B491B337BF46866B41792D232E78786BEA1D9ACDE75266F6E0E34ADAD9A616E5E5D1A144C59BF948321AC6A598DB181
Malicious:	false
Preview:	.=.,.M..)S..\0F....k-.r,M....ub.\.7...n.^..P3.v.1.Ivm...l.~..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b193722b-d9bc-495f-8e08-$.@%....:U....P..Ea\|.`[..b:N..!...`.P..Ye.$...#WZ....!.}.\s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/P.>?.G...pb.CCm...../f.{'....q:...q..B=.....8.Y.<..}a"....m.sB./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll b..^.X..=_..\1O....)5.x0o....`eOF.....'.....:.7.6.Leq....n.d.\gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200$.C).M...,_.O.a...}>v.v.[....};\E.".Z..8.....!...fve....M.$)CrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvVg..c.B...mr.OnO...\|,6.P%_..K..y.(...=

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26654
Entropy (8bit):	6.707215279934476
Encrypted:	false
SSDEEP:	384:tY89pknwUZUyiq6YxL+NCbL3fd9rKFSc5Biu2WwYYId3KzhrqUeEw0YRm/JwoTWV:39pk1Nxqe3fzmrd6dtN7Y0qoTWWg
MD5:	28B4BB1C10D592C063E77D6C10905135
SHA1:	7530E62A22E8C43D8E27B49C5994881A61C3774B
SHA-256:	9E8664E26978BBC9AABCC0E885D65617F19548A84B62E2F644F0438214CB2E85
SHA-512:	8A91A21763432372D7B0CB5ADFFDCD67C6F0BB331AC0397B3DF54B64C9DF760867A2C4B4602F288EE478CA36F580ECDE9B99988FDD3A747DB60D4671738FF641
Malicious:	false
Preview:	\|..r.[.{...E.l.$........,rU.@..d.{......D..v..)....FH..9xM...s.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{1bcf8834-7550-beea-c3ea-317ec14b396a}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.).=.N....Y..s.~........}-...T.k.J....+O.b..".......>2....v..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office2F72340C-B555-418D-8B46-35594..)x.a[7y8...`.w.....;qT....!.n......B..j..r....YP..t9.Z..b.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.. \|.w.8_Z...&g.m......#sB....2.5........h..#...QH.....d.M\/TM/v2" value="Office16ProjectProO365R_Subscription"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl=.-.:T.L8^....`.v.....`Yc..<...=.....ZS.i..<...WQ..xr....mTpriority><sl:policyInt name="office-0B6EDA1D-4A15-4F88-8B20-EA6528978E4E">1</sl:policyInt><sl:policyInt name="office-0B6EDA1D-4A.pAzb.[:.*...rB.,.......m#.....\|.`.....

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11969
Entropy (8bit):	7.049051715696952
Encrypted:	false
SSDEEP:	192:oujDihL2EGk5c/SfVYI7xEoa4ys3JS0v6wUmzmzfKV9K/:RjCgkCs7Woa45Ztiw+zH
MD5:	617E5A36A493EC230F9957FE190D56A5
SHA1:	2079C135AC034CC927D40160A99E3E752308F436
SHA-256:	1763C25155388E15C78CF707B71A3D301F17C793D714EB585F5185D827AC6565
SHA-512:	5568FD09791CD8628E952C621EEF20AA6F0C114F4C7450F3F2182AB946D03A92F3C30B3FE676F46CE7514F68E55BEF5409B82283BC1AA5F3087F67E3E302BB02
Malicious:	false
Preview:	.M..]..B......$.J3.B.n.e.=... 8....v..{..a>..6E...lzk.?..0..,(.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{de1d4abb-7ced-4062-a519-X.^........Q..k..dlUHV6.). ...7`..>.u..#i..o...E.J.g"cj./7Fs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/z.w.:..b..C.y.I4p..L:.n.....$`......+..3..:H...!ml.&.Sa..0a\itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProjectProO365R_SubscripJ.U.@......4.'..xpC.V'.e.n..G!j...e..~..a...P...hP\|.h.@8..`e.r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www...........WC.r..enB.L).).n..<.`.....x..w,.,....?JA.);."..0..aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQl...7..t..SX.`..:SA=h-.F.a..0.V.......w

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	20267
Entropy (8bit):	7.184757883137433
Encrypted:	false
SSDEEP:	384:KDoHe8g0tyAhi54A8pjNK1fu9rTfzUnP34jdR:AoI2yki0pjNKw9rLzUf43
MD5:	F58B84CC87C669559F12E527B4933509
SHA1:	115B1230F4AE12FD3A3A7BBC0CD8E97D6CACE00C
SHA-256:	AB2FBE7BD4934C9F5C433C533DA2FFAC83199F6B3A6833806B8D3885F6CC1813
SHA-512:	C615D59C5AEA10E3D61BC0AAFD6400D818FA378D884701F13BA6530531382E5D0A113E9EC90474758D75E0830190A1F1B62B3390107A870AE4A2773AE7770176
Malicious:	false
Preview:	.6.q..4HDJC.d.!.&.`..&U...........a3ui.{..V....?U.....>..s.Q.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{6a0ae65b-523d-446b-8e1e-L.%{..h@QYD./.7.h.=..~.V...F\|.....w{y...hH_.....\|..E.M..g.N_s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/0.[b..hV.r..{.m.8.t.r\..,..x....I'K.k.-.6.L.....?U.....r..6..C:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProjectProR_OEM_Perp"]H.dw...I.y^.h.<.k.p..t....3.}....hl.'.e.9."....-@...J."..o.MAertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.or..$}..v.].^.i.&.'.p..Uq?..$.}....2hz8'.6.49............./..f.X.YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr#.E...m.O~T..j...F....C}6.[*?S.....(Ht2.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10963
Entropy (8bit):	7.171695598314036
Encrypted:	false
SSDEEP:	192:h1VPCM/tbnLl2SCVr7x0K0yRJEa624NG9Dz9BjUstbEW9:XptbL8S6r7xmyRyLNUDzjUstbEW9
MD5:	95519E13ED296DEE7E00B60857E54728
SHA1:	A22C26A4F5704F3260C05C4930CDBB1ECB6C5EE9
SHA-256:	60A040CC075D66759C3D352DDA54E4D32563732F2C497CABFFD571231B7BCBE3
SHA-512:	1DB74A629C61BE4A405EDDDFA83633ED80C6E0E443E4E75198B405EE0113BEEBA72D4EA0F0373704DCD9DBF63EE3B1C8F227217EFE044174B9EE2E67FF3068FD
Malicious:	false
Preview:	d?P...:... ....cA.L_....2w....9.Q6..,..j...9..5.....A.....-3xrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4ba55641-1ff6-401b-b451-...X.`..r...^.3...U.M..$j.....\|.H .]<..d...oS.}...y........,,s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...c........L.`_.X..A..oW....;..p.Ol.L%..2C.9...'....... i~/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ...Z.2..,....\|].M..S...t..[..p.\..Vj.Wh...<..?...1.U......,,s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b....].o...u.....q-..X.T...v.)..U.@>..%.d...b(.(...........1.PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4..P.1...*...$....M\.....~..&L.(....J=.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20259
Entropy (8bit):	7.199612413498246
Encrypted:	false
SSDEEP:	384:VGQlYmjyIPaexJdHIgN5x1XiMKzl4mjbm6O:qayIPaE9IgN5x1XiMKzbOT
MD5:	6059CAAD424988F09A323CE5EA8FA5E4
SHA1:	9C4E00B5B3D6528A4AC1A863789C223B059C795E
SHA-256:	0F14F277C01C9FE6987F08366F9F161504CF98D6C7656F5AB4B729DEBC0A3B88
SHA-512:	9D8A49376A169EC706F03E064054A1FDB61068C4B73E2922F496582B4A3431A21A375BEA8182BCBEC9B25C11ED885DEE206FFA114EB1AA5F51CF95F0EFC0659E
Malicious:	false
Preview:	.c.9..I...y..-...ZK...g4r.B .....[...P.K.O.4..W).K...T...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{db26af38-e928-4c11-b317-..Sf)@.....i.@b...O.P...Jq)x.A7B........EB..L\|..~C2\|........s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..+*I.i....F..p...S.....:.p.E$B...P./..F.L.Q.O.4..WNIt...E.Z...:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16ProjectProR_Retail"]</...kI.H...n..+......S..E7z..5...1....O.l...._0..[.C...\.....tyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/..V5>G....o..%.....9(..R:z.Iy........B.KC..N....\_.j...U.....cYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZ../1%N.....l./!...../$.P\.T.K.....I....

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10967
Entropy (8bit):	7.145587938686868
Encrypted:	false
SSDEEP:	192:gxjnPaELWOT/S4uOJBPG9hfZFJcKFemILe:gVZWOm8zPG9hBFJcKFULe
MD5:	B773E2C7FDCB2234AFFF8AF3DDA5E1BC
SHA1:	B429999455C2DD356AA010E59587E2725DA08A6E
SHA-256:	E6C04109C428E0F91AE24AE1D9292664BFF9CDF7B2980027B8EE3902C78220C9
SHA-512:	CCC10DF11FA93D688DD68E25532588BD003C810B9C0F18EF0E81580F9ABECF8A3C5E224289804FC4F1981FB2AEFE6EEFFC14366FA199B8CCE298E22E5AADD605
Malicious:	false
Preview:	.y.O.@G...S.)..P....R...4.u@.5.N...3h.h..q..>........"..W..yrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{887f4404-f3e7-474c-9e7f-K.F.\......'..F..].......).&C.mZ...Slx.l..&..g..<..7...Q..C..-s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/9..\bJg..b.u...A........zG.m....f~(Z?..._.w........w..R.../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ...=[UO..._.>..Y.........7."..2V^..Yg.S$..d..9...E......w..C..-s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b..."\k........p..t.......5.v`.ZsI..{3ao...XT...........p..B...PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/47..CQrL...Y.8..\..d...J...=.ho.{.q.F{y.

C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11475
Entropy (8bit):	7.094996859267322
Encrypted:	false
SSDEEP:	192:hutJiQE6v5dgDkLZOgH53iE6JFf3m6deNHHGsLUc/fbP:4tJWK3gwEe53f6JFf3vdyHHpLznbP
MD5:	18A2985945868BE995431441743F1941
SHA1:	D37B9B0C6B14D402576C0B1F239DA38D6728276E
SHA-256:	005132ACE776E9540F6FC3C5522E25B550A3C8B4C700CA87F087DAC855C54BE3
SHA-512:	32A01BE5B8C846B698A267AED7311C70C84BB6CD5E0E79653039CC3921FDF01F05E1073547BAB0660E0C0CCA52FAE52580F3A5886D35D4D43099FAE559396081
Malicious:	false
Preview:	...X.3.M_Rz..0.J..m.R......;.yU...cP.......dI).w..O..g$.A.g.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{a5170427-b5d3-4763-9b57-..1..\|.B.AQ.{.\~.2..........8.!....+......w6...^..x...~.U.xCs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..HK.9.mM.K(_/..-............<.!W.L...\......gKE$.\|.....2>.D.=./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll <.w.&..]Fv..0.C1.`..J.......i.~...."........z%X..w..S...0.L.}CgPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200z.5].3.M.Wv.S{..A..........D... ....p.D.......3...f..G..6/.Z.V\rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV9.u..<.T..[.6#.C+....I.....N.>..@.U./&..

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25773
Entropy (8bit):	6.6584505281876165
Encrypted:	false
SSDEEP:	384:XX0bMIzFk4UclNd0EwgCCN8wq2Hms9plAaePq+ge7vIINWNED102yV+D3Phi:XQMIzphdhwxSPxb9fATLrOV+/hi
MD5:	DDF9CB9CCB84422AAAB3B66CE8AF8E6A
SHA1:	1E2623466134282E152662B4C8D5272233066855
SHA-256:	62D347A93D1056B69C5F463041620A1372EFC4B7788CA5D43D2524ED464BF9EE
SHA-512:	A1B7170C7CC3BA2EE7E50A02E37657172FAC1EC52E97122FD349D54A7802BA0E32BA3EEE69F3C6B7DF901FB68B458246E6AE36ABF5B2056844D90D7B6EFE39F4
Malicious:	false
Preview:	{Y....x;C.W....%.G........Z.c.N.M.._d42.o.l.....M`.R...foX...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{2e00d2c7-e8e6-db55-1bdc-a5a948ad2c0a}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.......)9@.K.........E..BB...7.B.\|?.*.&B.?.x.....[,P......}U....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeA70DB9BD-3910-427E-B565-BB8DA.#.{.<4Ke......v....P.....[.1.I..X..Yzx`.\|.p.....Dz.J...$4....15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.....7;m.......l....F.....M./.....\..1\|".t.r......#.R..;...../TM/v2" value="Office19Publisher2019R_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://...P..ftF.C....u.2.....5<...A.....O..\|{~.r.i......\|BL..}=....><sl:policyInt name="office-81DD86EC-5F1C-4DDE-9211-98AF184EAD47">1</sl:policyInt><sl:policyInt name="office-81DD86EC-5F1C-4DDE-..S...BU]......./.H.....B..R.n.:...O..\|{

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11948
Entropy (8bit):	7.06741076623919
Encrypted:	false
SSDEEP:	192:yxrScOXHLEGKOyD9fDWLl5RTK8JFVZ++4iZsMRvA4g:yxrhOX4D9D9fDOlLOYVmiZsMe4g
MD5:	EC28DE394B351E10F344670064533F64
SHA1:	ED2FB7EE6A8FCEFA234E7A1796C010A8D2B6256E
SHA-256:	341AFE69C007734414ECBB67993FE7E31F0E3B5A0AAD55EEAF8BE655FE9FFB24
SHA-512:	F48D59523DB3035A589CC6EC7880FBA847FD67ED4C29FC88343AE6E63BF643CADE9D154DFAF41AD6746470F76F87B02EC1A600FF240D191A02EAC9B8AED30AA5
Malicious:	false
Preview:	...y.L\..G.=..f...m.>.7.aQ.})./n.Y)....~NiH...;....F..;.......rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{14c99636-14c3-4c44-9201-S.'#.VP....\|..)...2.4.o[-G....w+.@?.X..z@+...i....,. c<r......s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/#qRj.F\|.......;.....z.c.j..r..wl..o.s../.;c...6...Q..".B...X.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Publisher2019R_Grace"]</..~+.Y]..A...`...`.\|.q.}s.{.(._..S..!.UN...z...e.Fr.......tyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/U./u....\.+..n...`.].\.vd.a"....I:.J..,3r....;..0.6..h...D;.cYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZ4lVq.......(..j...o.K.U57j.D .!6.{v.[.

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10983
Entropy (8bit):	7.129523988165
Encrypted:	false
SSDEEP:	192:Tvim7liadnbQwqICTF2+FeHtXgYDv4Vy9YU6uVsbg5:Tvh70aWwDCTQ2BEmmxdsc5
MD5:	97C7A16411F748EA43284ED083B790A4
SHA1:	6D3FBAB726A41F474C6D46C0654CB238DF4BEC17
SHA-256:	F1DA3785F1A5B4A87F59C1B1E6D7CAF60674D1C9D7A69D7D9EE3BC62FD91206B
SHA-512:	5C862BDE5B01EB8F7B82A86E622F505775938B4684A7A78C3E2BD06F63CEEC559CB5AF0FE1190C6CAC6F5B722F9217FC077C895E078BF2E6767B0D4D492DB24A
Malicious:	false
Preview:	7..y5......)...F44..,....<....V.Ft..p.V..ay2\.x+....V.,U...%.2rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{272c3e14-e82e-4ad2-bd98-..A.#}..<R.'.Qi.zk..}....!.......m../.X..#.;..c0...w...&.[.&.fs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.l=..?.<K..u.C3Ew..g..........9.=....{wfW.W'....A.......(.4/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ._..' ..,...>..vY(9..4....?....Q.Vy..$.../l2Y.}!\..].0..[.&.fs="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b.uD. ...>Q...._TXB..l....=...9.Ae..p.0..*Pm..,6!...@..d..!...YPKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4._2.-...XQ..8.+s,`R..T....5.....y1..8.F

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25778
Entropy (8bit):	6.677471041226207
Encrypted:	false
SSDEEP:	384:5QVug7a4zbEpNdBtWuCNmXKljePSIKV3PpPvHmbJfVGJwsWYqFu7ml9LVUWzI:u1hUpNd/fSblzNpPvgH9vWSUuI
MD5:	3EC200B104DA87874B13561E50983F20
SHA1:	AED6E16BDBE606BDAEADABAF91368017ABC36C42
SHA-256:	7AD363182AEB59DDB11D15AB977937276AC164DA0C98B70D044A87848145EC86
SHA-512:	7A17EE9E568876516724CA0F14226FD5EDFCC7AA0A3BBDA4BD34FF6297D90320645A96BD23D1F41DDEFA2E129BDDD8B2D7082998BD8CE2B3A4838FA055F38CC6
Malicious:	false
Preview:	...m.W@3..Fx.-........l..6.z....j...\|D...F..@..Mc..7.._2.4..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c9bded1f-c467-0afd-645b-d24797a3f8f9}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x@\.h.B.1..Z1.2..O.YU..8..b..U....j....+..B..]...&A.-... .6...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeBDD04A4F-5804-4DC4-A1FF-8BC9Fi...f.y.C...G.!...G..@..k9.7.(...3....B...f.....W\|..=...i.p..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X_}..}.w.e...7.&...M.uV..o!.!.6......h..l....@..H.X.t......W..../TM/v2" value="Office19Publisher2019R_OEM_Perp"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http....%..Az..[x.$..M..v.-....&J.....e....B...@..Z.H_+S.v.....(..ity><sl:policyInt name="office-81DD86EC-5F1C-4DDE-9211-98AF184EAD47">1</sl:policyInt><sl:policyInt name="office-81DD86EC-5F1C-4Diu..`...".r:Mv.........->.h.{....3...

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11941
Entropy (8bit):	7.055844761873727
Encrypted:	false
SSDEEP:	192:kMRzBR7J7jCi0gjT5Uu/tKchvfoOyIypOwME+lmmLD3:kMRX7J7jH9jT57zvoTME+Am/
MD5:	9E942BE2FDBD11654B7D932CD2EB410D
SHA1:	1EE01D3FB5E2DC6148854481E829E6D4B4785D54
SHA-256:	10764BEBCAEA261AF5CF38A1BE350BF8F8ACEC0A1161AB5C5AF8864E5E3B6D52
SHA-512:	7D0F6F717AE9ED5C46D375EB8D66470F4F698036C13451DD6758C59B5BC3F6E8EE7C4A399FD8AFC03BEBE164386E7F6CC6F5AA7FB4ED41CC6D9DC09C2967F712
Malicious:	false
Preview:	....fFt.Y.......K.).k.b.X4.t..."&].. `!...qq....}..K/7..u.5rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{ee4c492b-a437-495d-8973-.*?.n.{Q.B...[.....#M3...E>.w.m?K..0n%..x'J.....u\mU.v.as:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.O...LT+KU........mW?.iDx6.s...fk..."0p..."~......j..RlfI.i.{itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Publisher2019R_OEM_Perp".!q.c_w?...........'.d.6.X".v...%h]..C3s...9S....J...1s..k.`pertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.o.zq.i.)HIC........Y.'...M1R).{.inv..w3j....tL...u..IA~..b.u4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExU.J...w-S@Q...(....8.J...A8dh.Y...aA..;&

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20285
Entropy (8bit):	7.221275706968453
Encrypted:	false
SSDEEP:	384:ZgRQBPlp3yecCCV4yI9nq6j4ifmEoqMW6pCkASsJW+9Fmb1rA4NBdc:ZwKlpcCCeykpm9qQpCfSgJyA4Nzc
MD5:	DCD86B471F58D1B1CB1A61F9B302A4B9
SHA1:	CCE24B81BD15F87C6F45D04D158F7386A6D81155
SHA-256:	F7B3CB9DADF670D0FEE5EB12A5B672F229227033221513C6CF70B897E2676DF1
SHA-512:	EF123A440C5D0533FD5C48419E8F7B8C9E4CC411DE5B84B98B97D8BECFB537E327791B348395562A3A8E578D2EA6A1EA0D4EFC48DFF0C4C137262DAADC66E10A
Malicious:	false
Preview:	WL...@.4.[`Q....A......Z.@..=.....K..........>T....X..t..Trg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{bf69c7d0-1e20-4c57-acd3-........#@X+_..A.^..JY..]..>.W...].Z....W..Z.l....>..........s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..;..`.&Vj_....._B...F.Q.`..:.W..J..q.......,.>T..E.X.e.....:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Publisher2019R_OEM_Per..+....z!S~g...I.C....X.....!.^..O_.[@.....S...P....]......ropertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3........$V.+....H.Y...Xf.n..*.S....p@........4...:.G..~.....6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlE......b. M.9`..K,}...aWr.b..k.q..w.G..

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10975
Entropy (8bit):	7.122030803454742
Encrypted:	false
SSDEEP:	192:4bblWE1gPkezXgRd5Hy/34L3Z19H1H0mKl8Y3Rr/I:4Nr1TTne34DZ9UXle
MD5:	33CFC63E226F9A8DDE2B3680F27E36A2
SHA1:	0025BDF29AA24E58115C2C7E493028B26D27CF86
SHA-256:	82A3E97EF4B113A74884B1868F4EF2B51875C4FE735FA39EBEE88A0D0DBDAFCF
SHA-512:	6EAAEA3FCADF9F5175FD2800EF7E57C4CE0B70FC4C43B9DEBC18D6DD3E39C2BD60811F7A6033FCADE054257668701F50D542771DC34E1FDD2BDB2F491EDAF0E5
Malicious:	false
Preview:	.../.z.`....f.].T.z$K.+.....Y.mR..\r!.UL....r%...\|.2.b....t.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f4a6c2b1-0e26-45ca-8ca2-2..!.dR9....-.K..T'...sC...N.(....-1.QB...+w......\....k.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/B.t<\|p.@.....y...JHn`..".U....].o..!?aL......;....H.}.B......./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll p.K]Eo.1.....f.T.H.{fS.!....L.$B...&gE.N....u ...^...~.....k.s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b`..BBQ[d.....{.}.8}.#..:5 ...P..U..<r(y$....Pq....q.?.*..../v.PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4L.{#OH.h.....?.Q..m{'3.>0=.....\|m...:0.

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25776
Entropy (8bit):	6.629152578534056
Encrypted:	false
SSDEEP:	384:xXknG4RlLgrOcn1cHltsCNu7bizl+WHs8ePAv6OKcApAEgoBnO/s2ecHD63bgElp:GRRaNo0SKizl+WEdBgoB1CO7lBv
MD5:	C363B56E1276F6C3CC184667C7E243C8
SHA1:	372BCD3E6F18EBBCF54118AF9D94F12CFB8D8948
SHA-256:	99759C6566FE7956700A67A72049E0EF1BEE2F5DDA5CF745DDE642037C4E84B4
SHA-512:	2AF1DEB20A71302F8418CACE23EAC6999AAB494A1A9E72DE972CA97C67F68EF39C8D651A4E20467E8F83DB4DE6AF1ABAEAD1FC2DA0C8F842597AFC92A1F5D4F9
Malicious:	false
Preview:	.<#..v4.c.b@&...;...<.../.....*....1$...->...ns....p.@t.<...eG..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{74145650-6443-072f-4af0-f3ed113c28f1}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xA...c!.a.u\o...a.\iS..{.F..}....$..]Q...j\|..Y.<..p.;.D.hE...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeF053A7C7-F342-4AB8-9526-A1D6E.....<j...C.....h...#F..(....?...9}....8...Nt....j.Xq.q.N.!...15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X^...Z..5.%.i...r..BEP..,.....%....x&...=o..hc....3.@7...Q.5.../TM/v2" value="Office19Publisher2019R_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:/....c0.1.t]3..i..h^y..3.:......i5..cp..nd..Q.`..k.u...(@..y><sl:policyInt name="office-81DD86EC-5F1C-4DDE-9211-98AF184EAD47">1</sl:policyInt><sl:policyInt name="office-81DD86EC-5F1C-4DDE.....#h...6.a...2...=...-..........i5..

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11933
Entropy (8bit):	7.014251078774239
Encrypted:	false
SSDEEP:	192:3h87zS21Sb5aAbTodVfzajExJtmtzGgexx9dZQ0DtwX7T:3e3nSVaTdVaiwz8nDDt2
MD5:	E02C7AF5FCA0ABA620533EA07B1032BD
SHA1:	DD4A78BECCA2A0879187722C9E04AB95927FDE7D
SHA-256:	0DE1F87584B7B6A5C8BCDDC59E83622AC03BEBD750927BC964892DE0CBEAB7C1
SHA-512:	2679B221EE2D2E60AB856FE0A72F2B9CF127871B6C460E7CA26FAFBD7FE36290AB4612964F4232C660E70040743E8238AC8C3E0BC9F46D4E875FB431192D349E
Malicious:	false
Preview:	...1.d8'...[.W...V.f.@-.q.._.....&..8...R0.....Y3\...Nv/..c....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{679ae02b-1617-4e3c-9624-b9.=..bz...K.......;..uB=..UA....i...g...\rK......j.d?y..mQ.....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...".n.....d.H.N.H.r..y.zG.]....b..L.K..b7....O8....Co6]Z2....itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Publisher2019R_Retail"]<u(.l.D8'y..[.M.....t..7.p..W....5...lQ...05.....<_. ..=cLI~....rtyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.orguh.=.3er...E.M...V.t.1L4z..Z.........lHW......._.`.']SMn_:w....BcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrW...D.(l`~..x.q...9.{.'@=LA.x9...)...yY^

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20277
Entropy (8bit):	7.2421865651466515
Encrypted:	false
SSDEEP:	384:SCRAiBLbw/GyU1uTv1Y0NCnJLrrLm/UJHQusVk3X:GiBweyUIO08Jfnwgikn
MD5:	AE49BA9B078A60C7FD0E86547F11ECC2
SHA1:	9C511E948605B097F48BEDD0F9355636F2F8F069
SHA-256:	C7C8B4C2EB4FAACB14C8C178F88A6CF2E242CC71918E640544E94816C8CE8B95
SHA-512:	D514A9511D36903A0CE41B400DDC406CE0070D88440F376DB2CCFA87B3ED483302449198B0281387B31C3A220528FD8D0165F6979578F06823A20AFFA067DD51
Malicious:	false
Preview:	\.....j.}....F..lu.e....;..u.3.frj/-\.....W...k......\|.X..xrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{224eec64-6a3e-462b-8991-..Z...4.l......<;.8.....-..&.$.#=s9e..........W.*.........,s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..r..J.o...RY..ok.q.....f..z.7.d6'iU(.....w...k......0.V..D0:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Publisher2019R_Retail".....i.0....]..">.%...>..].8.xu$/o.......u...8......b.G...-pertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.o......7.m....C..80.i.......J.8.!9".o......R...m.1.......T.]84YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExU..e...3.d...O~...4..........D...#]-3/2..

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	11487
Entropy (8bit):	7.089525743460698
Encrypted:	false
SSDEEP:	192:WLqPbyb6fOQq3wtgLlMd6tdM+JbhgEoo8wzuOD:ZPWOotJ83TwzF
MD5:	87FD3CCB54902300092B9804A1DBDF69
SHA1:	F9F920DF2F6CD5C56EC9B00A5E1FCCA03C214350
SHA-256:	DE713123AED3B759985966BA1BF1467BB535384395563B658D8B5264813148AA
SHA-512:	9C8D0ED3AFFF4691F5A5B535147797128D5ACE14FEE4E9DCD0B81E3CD92E88CA009318BA72338761A85E392F208EFC0C9BEE79D777ED9B779D2EE4F1EFC9089D
Malicious:	false
Preview:	....v....:....,.o`'.$.........;.....u.Gm/kO.u^........s.J=^.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4eacf6b4-5f42-4013-9903-JK..-.....n..K..\|.0=-J\|...F....t......q..:&=..=b.....[.i).^>A.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/<.:............./.,tcPp............F..."W]c{`..yS..9.^.Oi.O0../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ...c(....6....3.bae.b....B...!.'....*V{kxb..dY...=...\|g.G'D.gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200HSG.f.....6..K..C...r@R....@...."....-~.]fO..?e......Kx.Qgo.rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV.L.^1...........)...`.~...............

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25825
Entropy (8bit):	6.5767470554861065
Encrypted:	false
SSDEEP:	384:njQPPgynRlQu8c3MvN4ZrTK0KeeN5yAIo/O9n69vhy76W9kScRiLHaj4JyorSZxL:j47ciZrForKajgxs55
MD5:	8C2189A8E4DDF47817C02AD7CF527A16
SHA1:	2ADD2222F5D2FF8B90CB74C92405BECE8A0B7B4E
SHA-256:	873AEFA3658D455E1E43028D49CC4669783597403D0561086BBD767FCCEA3313
SHA-512:	84BD1B7E7B737CFFDF915520D00FF20BC1ED2D7F2F879906CC19D7DD29F64604A01677E9B13B2619526EF7417B434C305C248182D9A3F28CA9133A6E98C146A5
Malicious:	false
Preview:	.DKr6...7...+d.bQ.!ma..$^<'.yp...??..nd.t.hs..9}.(.n.;..zb.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{fac2d0bf-3fcc-c765-ed13-173e17966de3}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x&..=3...4.../{.8I..8$....{.fs.u.....JE.\|.4.`.gx...u8.,.iJs..xg..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office771BE4FF-9148-4299-86AD-1A3EC{..~K......+h.1..3r1..'_ku.~5-...9!V^hw.h.o(..#b.-.#Ay.B>s.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X9..\|&...s..'o.+..a.'..%Ihk.0&/..pjR.?..j.xy...zj.k.Owf.VB\./TM/v2" value="Office19Publisher2019R_Trial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://<..`d....2..lh.2\.].l....y....2`}...k'U@;y.q.r(...%.(.mH .Vfd.><sl:policyInt name="office-81DD86EC-5F1C-4DDE-9211-98AF184EAD47">1</sl:policyInt><sl:policyInt name="office-81DD86EC-5F1C-4DDE-r...$...p....O.hQ.>al...$V<*..<+...k'U

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11945
Entropy (8bit):	7.092931586913389
Encrypted:	false
SSDEEP:	192:0KvfohT9EMqnsrSHPWBPEv39xqErw45T8hU1Sbe:ZvfohpNhYI+/qEr4hU1SC
MD5:	02F3A97A01379E9F18E4292701B1D3F1
SHA1:	A6D79AB00D54C9BC6D57D4CA47302138D2DD319A
SHA-256:	C1847C5F787580881D51F62FC7425F12DD4B65AA359C27F6B35275C7761CCA7A
SHA-512:	9EF9972D51FFEE4F13D4E8CB816174385608FE28271C689E23C4026397D6A603C995BBD41D2ACFA6AC470EAAEA26A8DDA520F9849FFFD33C605D02A811704456
Malicious:	false
Preview:	.T.?.P9........n..-;...@..`..w..Tw.....%........;G..2.w.Drg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{74933e1d-6ebc-44ee-b036-_.a..d....._.>.Up1B.....j.../J_Ma......r..w......cy....t..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/+..,.Z.......M.m.I9.X.K..b../.T.1..L....."......."^..cXk_.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Publisher2019R_Trial"]</...m.E8........=..,y..\..h...pK.RP...B.#..z......rE..-.i..tyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/].3..m.........q..QXp..W..h.]v`.Dd....O.t../......V.i.-<<cYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZ<..7..............EN\|....F..9yWJv(...

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26057
Entropy (8bit):	6.66884736325291
Encrypted:	false
SSDEEP:	384:1TB3U4sSsStbxCU6OTkk2TNuf9wIyevc5iu61mlpHnu9Xix4wWb3C006XLPS/KcZ:b3PTeyGACHu7nNbaxyU
MD5:	25550BDA2F12C0421D9D894CEC948BEE
SHA1:	DD46D85DA20DE50B22A4D828640BF61A7B3926B4
SHA-256:	AB8BCC2C0C5C396D6E2BA66E2DC5843199F28E363E154236ED4AFD4FEDF3CE09
SHA-512:	91608D3749EF3A414966CE349B5AAA324711494117315CB3090337A35F286813C3545B328412929D8C60A8638E3A4E33708BE81715B5C1DD6DEC7A2DCB2AF2B9
Malicious:	false
Preview:	..v.E.9.h;..Q...._..Q...,.J.....[e.]DSv.;J.2.>. B..y.......o.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4f99140a-fd40-bce4-899a-260e8956b907}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xa...P..;..'..N......PC..s...\...jO.(>A..kP.6.5.iT..6........j..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office9D3E4CCA-E172-46F1-A2F4-1D210;......I.Ii..]....M.EK.../.......Nm.[Z.$.(....eB K..a.....E..~.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X~..i..o./w..Z......SQ...-....U...,....f. ..4.4.'..y.#...{..QU/TM/v2" value="Office19Publisher2019VL_KMS_Client_AE"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl1....M..6.z>..W......C_...l.q.Cy..c1.6*C>.kN.(.a.!N.}........n.:priority><sl:policyInt name="office-81DD86EC-5F1C-4DDE-9211-98AF184EAD47">1</sl:policyInt><sl:policyInt name="office-81DD86EC-5J...y.4.?x..O...I.r0..a...CR._l....

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11980
Entropy (8bit):	7.041111043307418
Encrypted:	false
SSDEEP:	192:YeS3yOjynngd505Nuc1jIHn/2oUzCZlpenN6icFnqx7wP:/KBuS5YuMjIf2oUklgnN6iIawP
MD5:	19DE75071EEB5C0C2F3A45DB9597380E
SHA1:	8D5733B707375F57E38387271E29B2ED1C41C1A6
SHA-256:	BAD714C41200AD2C073B2ED7C0FCE9C04449CDA63AA47DA80D27FB0856635FCD
SHA-512:	9B6ECEB3E7581280889934A8C5FB20D90694DEB08684BEB6DEF93D1688151A57928D7CC4A2B519ED2CBA0FE7FD5F1D6FD627C409075B312A0B70AAD768FB4844
Malicious:	false
Preview:	.W5gg. .&.*.u.)........mv..h....B....^.Q..Z..I.sUHO.c.J...!w.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8ae90c0c-70ad-48f2-b20b-9.hi.yBdQy.{.f...\...M!`..;...........Z..M...Q..E\|"n.;.9KQ."h.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/O..t...>4K..).t....V...f+..g.....@.......1BU.._. ._H.z..@M_=>.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Publisher2019VL_KMS_Cliee......N).u.h.+...]G...l{.[..X..E8.....Z.L.jZ.@Z.r~nP.+.....+&.<r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://ww\|..hv.?.)V..6.v...CF... 7.[S.#.N/.....\.L.^Z....AY9J.~.=&..~v.1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsZ... .?%\7..2.....~E...AX.TG./..!....

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9969
Entropy (8bit):	7.04020275403789
Encrypted:	false
SSDEEP:	96:7Dm/vd01LgRA+KROmomWgjKQxcwDcLa2pWK3RVSPEcUaf3qZkz4iDAaQ/9MS6A9c:QTPmOrmCxsEczf3Ukke94wek+s3a0Kng
MD5:	3321654CC512393198B12EBF0861454A
SHA1:	CA06FEA3B441245E2ED8248571AAB866134B4664
SHA-256:	5369BDB609436523B47D8970A55281820E5D830B024C07B708DA1C3055A976FE
SHA-512:	CBB69CDB536E4F75BE9BCAA138B10E13A42DCFE8E869A1F8157FC2C042F0A6D20BD99B5CA92991A8944F38A16D5E0A0D7B7416B3ACC87564F400FD6C92B606D1
Malicious:	false
Preview:	..&.".......p...z..3.c..c.T"....ns:.i.u.."...Q.>c_.5../U&%bA.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e1c3e2a5-f555-4805-90e5-c.......X.;.8.4J.9..;...i.W5....x;e.g.{..+.N....J5 .L.\.k1a^Ls:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/C...E.....5..o.b.dV.w..j...a.S&..O(.N. @%..}.2.W.#u}Sr1.mA"*%..r:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Publisher2019VL_KMS_Ck...i....].#...5H.{..c..h..y..g,C.:.u..~...X.mpy....j.i(\|BKd"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http:/(..3.......).p.h..{..b..$..y...=m'T.:Z,..U...X.>8t23W.WE(.CXL1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0v..O...6..V.t.a..q..a...E.iv...4[fZ..

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10979
Entropy (8bit):	7.118977973643197
Encrypted:	false
SSDEEP:	192:TycE5xYNhUtCLtzj0ZHULcDtnUqP2UJdt+Qm3aupAJ:TMehwCLtzjSHUwD5UQntjmZWJ
MD5:	64ECDF7616BD9A786B85041973B0F47E
SHA1:	FA78D652C7F5C20FD0074ACD903F91C382A17EB9
SHA-256:	568C019177E5E8F1E6CB43F98B4B7104C4B4AA671BA69541DC437D2F5892A9F5
SHA-512:	161FE46D9105671501679D1BEFFD458D73716577826D1DD3973DCAA2F28FE8757D4FC1A9C76187837586C420FFC3188AB1F77E311D6A37D92685DDA5F749BFD1
Malicious:	false
Preview:	..k..E..p.s.y"t..fv}..a....^q...z.2..V.V%.31}p...Cl.........rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e9d0bba1-56e1-4dfe-8b40-......f. ewi;.() ..9.....]fX...l.m..R..r.eh/8...)M..$.......s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.8...O6=bTB.%=)..x5i.5.....YuX..<...Y..L+.8xR\|...w{..:....X./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .....P.Lr..2n"u..z{\|..'......d....T.f.P...0.66xz...ag..........s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b.!...nC.`N&.Z?k....... .....~xo..r.2.l)....h.)m...Nz..R...#..PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4.....w...Ny.h{A.2.\|..y.....q#N...H.z..

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25992
Entropy (8bit):	6.640387112952446
Encrypted:	false
SSDEEP:	384:28gp7uTiU4v4cppHVvaJhbEvIRE9rXaeeHOcLsG9XdW2mpDbjLzSwEg5mB:5TgAcqhbF+9bKLh9aLzD4B
MD5:	CF9279C2CCE4A4BA3844F13DD0F4048C
SHA1:	AFEA4FBC8770656F70336A013C83CD70D1F03C97
SHA-256:	813498A642CD2750E05CC25BDA6D083FC41EF422B093EAF7EF6D7861EED7885D
SHA-512:	5DC4D900729092B34866A0599352B165958E7DF908B4F1D8A6B5554F5198B251A6847A563C73D210449C40D326AB355874E2468C322B912F74359F31904787F3
Malicious:	false
Preview:	.U.....Q.X.TS.ph.09.."-.."1...$.zF...).G.../.G...^....?.k.c;.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{6dc3c44b-730d-6e15-0e10-450775477b54}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x......S.O..W.{2.lg^X0y..}eW..(.]w(...;.(...+.L.........uCy.a>..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office40055495-BE00-444E-99CC-07446J....-.!.y.kS.{;.d+.M8<..!0Z..#[}S...e.A.....V..D....~I0.'*.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X......%......_.w!.nyr["0..#&Y..mH..K...a....).M.......#.HV..[../TM/v2" value="Office19Publisher2019VL_MAK_AE"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:R.........R.H\.06.l8.mOg....V..U.y.F...z....4.V...N....?.$.y;.ty><sl:policyInt name="office-81DD86EC-5F1C-4DDE-9211-98AF184EAD47">1</sl:policyInt><sl:policyInt name="office-81DD86EC-5F1C-4DD8....E.I.{...._..65..>g..w%...zEF\....z

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11947
Entropy (8bit):	7.0015999925044525
Encrypted:	false
SSDEEP:	192:ZHKkof2Az+3XI4ITXNUOloI55fwEIa4vmdb1QE:V+uAzWX49Xlow914edb1QE
MD5:	35D6977661D2AB3DCE972ECC12BD8F60
SHA1:	59842060321036AA1382683936CC7B44BDA4D143
SHA-256:	4CDC007DDFB9430C7FCEAB7527DD13175334272D053601871E5C5768EAB22177
SHA-512:	97EF44C350265470211391994D749A50877CA569AF910B7A1BE620A6E467883C0751F365B1B8D7FBA473566A621ECA22BCE4B8E0B644573C24DDE82FD7FD090B
Malicious:	false
Preview:	...I.\|+...+2A!X:.9..xeH...j...p...m.d.Qv..S..\|.K...&<7.hcZ.i.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{60655763-7367-4f50-b55a-.$...f .../xOj.,.w..r4.@X.w...(HJ.{.;:._4....[4.}...d..2.N.vZs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/y..Z.v.......>.v.'..<.....J...(.AA+..(...$..\..j.....+%..92.. @itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Publisher2019VL_MAK_AE"].j=O.j....60@-D'.t.th.G..w...q]J.d..d...e..^..$.Y...-ky.b4F.uDertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.orZj}E.4i..6-^,D=.8..t.;<1.\|...(.L5d.)d..Sh....2q.o...x;..qGO.`.YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrj..:.0r..<rc/x..Y..{.-08.=....uC.$.eq.

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20291
Entropy (8bit):	7.227725711741431
Encrypted:	false
SSDEEP:	384:WcmHlgjrU1y8fTpMj9V3qLwKtc1yw7001Z2Sf:PrKy8bp4V6HtyyY07Y
MD5:	A1B01E76DFDAE5AA1FD1FC260E5A9740
SHA1:	3086920388770AF7F1B7A10A849336B5E91AE2CC
SHA-256:	C174F9287E98CC047E62C6254905C1238BC538A08526590DE0D35F551B085666
SHA-512:	5F3E51A16508C609A9C9C3B4423D5749C7ECE2FD2A6705D43F84AE2A51CFFA6B2628ABB2A49E11FA4CB00384964521223BE65603E2B42F74B03C6129DDFC7382
Malicious:	false
Preview:	B.+........R...9....e..i&.'...Tl......eE..\.]<~....s.......rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8889a037-762c-42ee-a437-...R..K....\...i.AW..=..t,.$....Mz....$.2L....a.W.55.M......s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/....i.4.......\:.]...1..I$. .........y.g_.\.]<~.N=.a..M...:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Publisher2019VL_MAK_AE....C...w...Y...w.FK..y...`-......R0.J..z.t..^.Vr9....g......opertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3........H....Y...w.H..y.M'.......6.\..c.<....k'x.)..2......z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlEx...b.L....S...K.Lf..v...D.......z9..n.

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021R_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25694
Entropy (8bit):	6.631802240586063
Encrypted:	false
SSDEEP:	384:X0PKrU2UEyQCf6EZjdWNGJdmxQfzAFyc5qugi8EZ3gbEZiwCjM6DvKgvtqrKZzI0:/r0ZU4d6QUlHi/jR3cIWAAj7o
MD5:	EE6D91306D5A4E2CEA80225B41719BE6
SHA1:	8976E4CD71755FE4D3643F0FC372E263B812F087
SHA-256:	902C221CC0444E89F96873B12FD1695609350A311D3C93B9E15E8F5DF98A6F7F
SHA-512:	90C79828EC82244036F94BFCB08EE91E67C41715779982CEE3BE871FC49E2A1D49518AA79D0E755A9914BABCC2D834B736DE23407BF8E1F3BA93F8D24674F8F3
Malicious:	false
Preview:	.L%'..n.b.a.h=]b..oZ...k.Z.\|L.5..'...H..V..G...w.;..........:n.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8d7e6373-d855-4f99-7bf7-6ec693c033b7}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x@..h..{.`.v.!9Bi.3..Z.?X..(.Tb......=..&..]...\|..-.:].e....8k..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office3FCD9CD2-306E-4B5F-A3EA-141B7o..]..E..?@.W=Qi..;H.O.z.M.}.R .T ...N........,..2.`..u...~..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X_..)..N.4]&.'1Ve..1..Y.v.U.k.L:GG".....F.....}.p.h..U.....P./TM/v2" value="Office21Publisher2021R_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://Z..5..`.-.k.ozQc..&...\|/u.7v"}E.p...........,..n.(..+...&h.><sl:policyInt name="office-81DD86EC-5F1C-4DDE-9211-98AF184EAD47">1</sl:policyInt><sl:policyInt name="office-81DD86EC-5F1C-4DDE-..*.;..^<.^.v8..`E...bXI.tL.+z]&.....

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021R_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11948
Entropy (8bit):	7.120438296001592
Encrypted:	false
SSDEEP:	192:cg5OmJwXEJCKPTp8kiC/306pfdXuhvoWQoTWzVVzxAIEgZn:fOmJyEJCKPTWkP867XsjHKxAIEgZn
MD5:	761AE5A96E1B730A2BF0B3D189F62DCD
SHA1:	01B9B77D9AB01EBBB91E499D0E60FE12503B2E43
SHA-256:	D39E27C7888775815D5E4632EE56B44AFE389732ED6EA30F2A44AEF116065196
SHA-512:	57A4E98E267CF507E059BE19667193A5EC35C68AD8C8DFB6F1250CEC966A9073FFC8DC818C6FAB21A15ACB394C7AEFB88BB5978FC6E04779350D0A02FE3A9742
Malicious:	false
Preview:	...?h,x......V5..H..W_.......z../....D.QO..).d^..!....r.&....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{91e6cc3d-48c6-411f-a92b-..%0f2w.C....z.....]........."..6..U.J._....6.8.........k....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.hY,.&X..X..Ih..V.......P...."..j..~.......&.iH..l....1.w..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Publisher2021R_Grace"]</..um.9y......L3..T...G.../....}.)..^....s.. .%Z..-....h.9....tyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/..$3xd,.....V=..T.4<...8.....{.?..GCE.,T....dl%.*......}...cYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZ.u]7cm>..E...r9..9."0...6....t....VJ.

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021R_OEM_Perp-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10983
Entropy (8bit):	7.166999650056912
Encrypted:	false
SSDEEP:	192:LROj8x888y6mlPVkjrbCaLWd1qO7Ydi/o+H:VOje8v+9qjnLaqO7YkrH
MD5:	090C1D557AFF5C21682B01CF9C619A27
SHA1:	95A607AC0ADE5868E4D88A8DD5B9CEF03660AE41
SHA-256:	F48C490B46F2DC5436529F3286627C38EE772C68618C1252A1930D684EB5C63A
SHA-512:	C30D5AF25367A2370232BCF88BD984B2E22F5576A9F036E9D62FC170CF4FE12047F8BD939A6B9D20246FAC5DDD5FDD9724FD51B81DF29790ECC87D70FFA09A08
Malicious:	false
Preview:	....3..@W.C.).e.......D.}.w....f...\.iRb.:.T....u.;v.......F.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e2ef4dd0-b239-4f7d-b77c-dX..n...EC..'.*......E...k.}...A#....y\f.x.].C..I.QW...n....Y.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.<..T..`E[r.u.8......_.M. .u...Ad..!.).5. ...S..x..a...H....../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll +...m...U.O.>.d........N._...../...../...t.T....%...}...H...Y.s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b;%..j.DGA....z....T.U.U.V...v...<.`4..q...8..X.6`..O....D.PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4....g..H!AI.8.P.....l.Q.H.$..Ww.....xB

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021R_OEM_Perp-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25699
Entropy (8bit):	6.65968798544384
Encrypted:	false
SSDEEP:	384:xLdyQ7jrQkUdkpAqUsVk6ooGNOvnZu3Ohc5pux6bENLl3hJWKowEJwM5EcqC0lKi:ZIE4WiqUsWrSerq/YKoxJr5ExYPE
MD5:	29D0DDCBADEE9C759B927356FC69F86E
SHA1:	AB322A4E299767C2532783809140B43439059729
SHA-256:	7D415EBEC369605B94761A45B4D87E365399DEE132652390CA0FE8078561BBDD
SHA-512:	6B630CAC08443C5762A3B455F015E41EB56B6455068C6C92EA5BD2D12D5CD4A93E5A25AC218D9947D7AAA5B2249F26C325BF918EE52C03B4D217409395E241A0
Malicious:	false
Preview:	..V.w4..}.LA..A..x@.....D'...(o<Zi.........eXA._1....KW....:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{db29753a-e0e4-375f-739e-1bb53564af8c}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x\E...b!..~.P...J...&...J...s...'H.pi....n....pnE....~.....E.....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office228025F7-CBAE-4954-AE9B-414AC..5R.6..s[..~..J...j_.....G&...mh)R0......?x>.A..@)..........15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/XCd:X.[..U9.....F...89.....E0...~jr.k...P....ooPF..H1.....2...J/TM/v2" value="Office21Publisher2021R_OEM_Perp"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http..Y..xw.Jh.QA..[..;_.w6.Y.....F5>.f.......niBK...l..........ity><sl:policyInt name="office-81DD86EC-5F1C-4DDE-9211-98AF184EAD47">1</sl:policyInt><sl:policyInt name="office-81DD86EC-5F1C-4Dul[S.>h..3.x...j...aR..G.Gy...ic.R0.

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021R_OEM_Perp-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11941
Entropy (8bit):	7.080716624818909
Encrypted:	false
SSDEEP:	192:VkpnKDrpb/Ws9E4YxRdPnK7bJzhRbYwlk2pXdhe2D:Op61hYxRd/KRtRMwq2pXdhjD
MD5:	3B2E4FD9794B67F4837E4CD319C79D4B
SHA1:	6EFE28882CDCD59F89843F2A434D9560D52A8BE9
SHA-256:	26F7DB7292D1707E5DA9FC2FC67905C9A96F0CE43C7FFA64609F86DAE061678F
SHA-512:	8B7389398B39278AE5851279F342013BFC644C57117EF13C8BCA567BDCF4A9BAC36648E2F9070B82364686DB12D5FB7218733E44CD034BB21DEE4AD34D1280A1
Malicious:	false
Preview:	.m..h.8..u.......%.0.-...$..+...(.U.?.G7..d......X>t.7.E...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{a31852fa-5df1-4551-9785-\|./.c.l..`......Pk.m.\|F.2..x...g.C.`.I3..3......gy.,.D^.....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..T......,..].A.;.$.fJ..y..$....o...K..f..O........_3m.tU.....itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Publisher2021R_OEM_Perp"..6Cm.;.o......Nn.p.3...!....../.U.u..e..b.......:Z8e.)@Z....pertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.o9.6.g.e..:......T`.<.3l.........c.~.c..\|..o.......@?0.YMI....4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExU9.Cb..a..(..@..,pd.S.<x...........I.Q..

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021R_OEM_Perp-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20285
Entropy (8bit):	7.212842465928419
Encrypted:	false
SSDEEP:	384:E2U6cp0yY37pjfo9UkqVT7anLeJBpQl79Tf4Hs:izCya7pjfx0CJ3a79T9
MD5:	6785F15F7A3CB35691550289AC7A8959
SHA1:	FEAA3D521DE5CD1FE97E1C582450451E0D982B2F
SHA-256:	7973FF8EE5EC9E660F2AE5F476C525254691235F0DF332ED2E8FAFDFCA7523D1
SHA-512:	516427A333FAA5B2D977C89B12A343C978982082CF3F05330B207CC1A55732DD753415E11F178F04FBD8AD6A453C26B0D52C254D8EFB09B875F8D0559EAA0088
Malicious:	false
Preview:	..}x..-.Y.^...x.}Xx..1P....[....k..W..r.e..hi.9..B.V..<DJ.....rrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{96ca10ee-a855-4cbd-867b-J..p..wL...W..7.-.'H.`....Q......A.b.a.H?`..k..t.<."dz9.T...&s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/o.k..0K.o..%]~F;..z....Y...i.U..p.3..js.9..B.1.*<V......::title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Publisher2021R_OEM_Per[..x..z...V...g.%.:R.}N...Y...%.XC..?..../%....T.3..9]..J...8ropertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3..#..pLI..Z.z.$. \.1N...t...%.....?....\|m.3..i.r.5#Z[.:...16z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlES....5M..H..%.'5.X.^#...}.......k....

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021R_Retail1-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10979
Entropy (8bit):	7.096833367789443
Encrypted:	false
SSDEEP:	192:zWrNQtgyMwqK3VXhBfRDS5WJG4Myhw2ApW6uLpvWg8qMUd:7gJnK3VXhBf85CMH296gVF
MD5:	584C15EBC88FE2754CA047B2B4619550
SHA1:	C88134554B07405E75769E86AB8B3A90C1FCEFAA
SHA-256:	B5C8F7B9324DF19FBB58042AB8AE52F55ED4D1F8DA21FCC91502332AFA863E4C
SHA-512:	6F723DA44652E92B04BD4F23FF71C09901CEAB07B7BFF96BFB7E30D1D500F85CD5F10693235068F8C22B561CC1D4CE3B7776E2CC2F9C37337E4C95DD282C87AB
Malicious:	false
Preview:	.....7d..m....z9..4....jM'"rua...JgH.a.gE>...1?.p.<..g...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f72e28a4-a8ea-4a50-80c8-..\....lwR.z.Z.*w.....l.....iZ.g=lw..DcF.6.1.l.'..U.(.O..s...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.2r....vL.R....y'.....=.....mI. 50'...0..o.l.....:...-.i..b.M./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ..M....ff..q....e%....>....8X kbxO...+J.t.bB;.K....d.i..s...s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b.+.....3tV.H....hU.....%...8.JDHNudi...,. .H.<gj.6.32.5.n..r...PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4..}...?.V.X.H...m.....!..J.E.i3M0S..Z

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021R_Retail1-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25698
Entropy (8bit):	6.66880320763633
Encrypted:	false
SSDEEP:	384:BIymjtJUsutfR6AXBRmNmjwc7tAmc56tfBu46jZpP4QUwUcJmnEgLvy2IlKkQREh:d44f1xR2WwQxZGnW7cM3vOQq
MD5:	526D91C6E66BF533801393EA7E82B28C
SHA1:	1678252C673902B9AA9F212EB75209492F836B6C
SHA-256:	783E8FCF507E1318D8D9106B4C500F1FD788ED6ED565D43C96C8278DF8353C68
SHA-512:	F25571B8F653137243529961E6FA68829AC49795434FB4838588030D8B274313E4E0B2C405485073819AFDBA75CCDCA10F9491A25B3F4D121E005D50AB093D2D
Malicious:	false
Preview:	G.!.....H..k.y@...............j....1<u.1....{Pa.h&.A.Q..j..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d7ba1ea3-bb69-fd9a-3a21-246656b04ff9}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.~.F...WJ..w.}_.....:............[..z.#L..+....2F-.'".F....h...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeB769B746-53B1-4D89-8A68-41944.S.p...J8.49.yL...../..............}ns.{..H.{Y{.p#.........15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X._.....E..R'.uK.....9......V.$..@.y,$.h....\|.".he!`....R../TM/v2" value="Office21Publisher2021R_Retail1"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:.=.BL......j.v[.......s.......n..,....b89.b....6.q.9e.^.S..p..ty><sl:policyInt name="office-81DD86EC-5F1C-4DDE-9211-98AF184EAD47">1</sl:policyInt><sl:policyInt name="office-81DD86EC-5F1C-4DD.?.....[P.6(.$j.....l.........A.p....b

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021R_Retail1-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	11937
Entropy (8bit):	7.096680880896595
Encrypted:	false
SSDEEP:	192:x/GibuFcDWQbehc9spyVSm8YC1D6fNjbfqo:pGiBDBb2noSp6fNjbp
MD5:	E007AD6062BFAC1B798E3F9B415A4E11
SHA1:	5F0EC92494091F4276DFA0DCBA7CE675B586C0F3
SHA-256:	8237F7E9FC47DCB27C4C0BF87B17F275C6DCE35EBB919681389E1C511112BE2E
SHA-512:	36DBFDDD2219D9337E9EE7F27847AD0F66BBB08D3EE9F2143392159EEB48D26B4E3B65FD9B6939EC2E50FF787F70C8D2CFF156438CB0ED2935CE3DBDCD6DEDBA
Malicious:	false
Preview:	...wz.....ZE.N.....9..q.....^...........>Jz...__.\|.`....L.8.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c68fb01c-8060-43e2-92d8-dU..s..........[.d..).....]..A..W.......7.#.7'iv}]78.g..X.'.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.>:d......kz.Q.....-.%....Y..ID.g......mEv.i....{.y.W...q.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Publisher2021R_Retail1"]kC.q$.....GG.B...X.)..#...%.\...A..@.....JG~.'WMJ g.7....P.$.ertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.or0CE{u.....GZ.C.....).....2.\..G8.V.....m.d.r.{u:`^g....Y.1.YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr.6$.......M..@...u.D......<.r..H..d...

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021R_Retail1-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20281
Entropy (8bit):	7.187982946827053
Encrypted:	false
SSDEEP:	384:oGaXAc1AzyQ9qkSFwf3GL4Q0QAPtG6n9VafVRgjTTmSw:gXV1QyQwkT3XdQAPtP9VkVm3A
MD5:	8C1F0DBBE259BBBD984A2EE665086F1A
SHA1:	2640E2FE1AA4A03FDC98A08602FEAF469EF0F41E
SHA-256:	AD373F02D9428046BBF9E483B643A489A1885535A0107978CC36B5515F9797AF
SHA-512:	AA5DAECDB7B8DDB99039647605FA23B99F851EF30C69FE956DD008DC05DFD61A0B8813EA74E5883420C5018B242DEC67FB197E1D8802BCDC43CBA34F6FCBB176
Malicious:	false
Preview:	."..(..O0.....N-..\.'.n.....n..fm.f`W...A%..l.r...C...<...%.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{50c593d1-5511-471f-8809-#...%O..t...q..;....v.6....m..#".p(.....r..U>CN...b./O..-:.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/P.n.O..o"..#..a..HUl.g..#..i..d*. .#..]'..l.r......p...\|y.:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Publisher2021R_Retail16...eB.MH...t.S&...O;.$.....A..z$.:+.....4..+n.y..A...>..z&.opertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.{.D.%H..?..t.M'..Q.;.Y..'..V..1}.<.....@\|...9.D...~..Pn..../.z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExA.t.D7..$...~.p$..0lV.M....X.....37@..

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021R_Retail2-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10979
Entropy (8bit):	7.106628477446548
Encrypted:	false
SSDEEP:	192:WTHRlcg49uwZ50BPUOm+geuqwN8OdQERxLzDV3:6xug49uwZ50BxpgDN8kXLnt
MD5:	26716B515271CAF46B99639D1CAE0517
SHA1:	26771BC3B2B5A169675FA8DB47BB914317365FEB
SHA-256:	6B1ABAEC05A391987B9DCC00AB04F3753036925B47502DF4550E64FFFDFE8B28
SHA-512:	10503AECF1290FB37ED9C256689870AF114F04944997BF51F2B3B4726ECC8BB6F73463F693EEA7C190A430EB37C033D2E22AE8E6E5CA46C6FF7165EDE75EA678
Malicious:	false
Preview:	p...b..........E..'9.C.k[.$.../v.....Apng..`m)..e...u.x..[].{rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8fa3717d-2a8b-4eff-b10a-.@...-.I.........H-hN..}F.w...j9....Ot`%..64{.3S;..B.F.%.I./s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.#6..h.=.....[..crBJ.6{.+...-1.J....'!}.Ek$...s...:.X.eZX..}/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ....w.L......Y..e!PI.IX.s...ff."....<l)..ej,._*<..L.d.b.I./s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b.:O..I........).w yWR.CZ.'...Cq....'..,.N;O}."a...x.0.HlH...PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4..9..P.............$A.V.^R.9.H.>I.>..Q

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021R_Retail2-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25698
Entropy (8bit):	6.668733769021297
Encrypted:	false
SSDEEP:	384:E8rvUqSl1R6oJPCNWDblDhu0c5ou+6+k4CH6RsEwws3ybBjPXPG+YKX+9en0cu55:JE1FU+bldC+vIy9Gxen0c4
MD5:	2D8F81F94BE518B64DE277D6EE6621EE
SHA1:	E036269102F5ACCD451F6696E4C587E60D5A7231
SHA-256:	894F92C74CAE43509D188BA3659F40BC65B6D7574CA4F9B9EE8D5673EAD6B0D0
SHA-512:	70A2975D6637206026E50BDCEA0591A46D37992212417DD93BD6D6C9AC82599F74BFFD63787726E0E0E246B903AA2C2919EE1832A066A1BA3BA9342DBD3040C8
Malicious:	false
Preview:	d.H...TR$isk....i..gO........5..^k.{$..b...._>.yu.6x..k...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f75fca13-3dc2-d49e-7b1b-65ccc31ab1af}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.X.C..A.&jdw......5..u....S.O].:(.tki.6..x....Bw..<:.,...f....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office5332506C-1880-48AC-B634-77401...r..}.TOR9......=...}^.....I..p..V2.eh...(.....>.fm.<5../...15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.y....t.r-4'.....7...gR.....W..c...iS.l...;....W9..nu..Y..;.)./TM/v2" value="Office21Publisher2021R_Retail2"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:...G..TWgmyj.....5......../.Z>.8...x.w...1....Hs..1$.+g... ...ty><sl:policyInt name="office-81DD86EC-5F1C-4DDE-9211-98AF184EAD47">1</sl:policyInt><sl:policyInt name="office-81DD86EC-5F1C-4DD........<^P(......o..{.........n3.Lx.w

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021R_Retail2-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11937
Entropy (8bit):	7.024838470467288
Encrypted:	false
SSDEEP:	192:XVsOoqw9iS54QE4zvdgnHhlZhCNbqdd4esdMK:FsOo19d51E4z1kM2ehSK
MD5:	A9FDF082AA5D298D016DB16232AE3174
SHA1:	178289F2DEC120041C508FDADCF744C4225FDA0F
SHA-256:	0E0807844B8FEE0EB1F7AF0E25F8675716041759C3E92EB364C84D7F02702852
SHA-512:	23A826E88DED23D4CE378A16B667704D3C379B2DD746B678C2EAF76B2D66AB84CEB1E4EB71B18B421A6EA8934C85CAAA487274BAECD61FE5368108337FDA9913
Malicious:	false
Preview:	Mw.]Q.j>y[.)IP..7.U.=....u45Rb`.......#..]M..y...Zh.r .@...%...Wrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b058358c-0444-4c9e-99e6-.n._.11l..9G...g...7Y...c)?.aw.....Q.3..S.../.R.f^........h....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.GN6.J.k....O.P4...yC...(.7]ed..Na.!N.....v...Q;.e'.Y...t...itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Publisher2021R_Retail2"]..x[.._?5h.+H\..c...1....y).W`9....F.mM..^..t....z.E;....r....ertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.or..8Q^.(b`..6V]..m.F.1x...s".Z`r.....P.mT._S..#.;.WL._<.G......YYBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr..Y.'.3kro.ik^.?i.).>l...Ec.xNW....Ab.xE

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021R_Retail2-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20281
Entropy (8bit):	7.18737627494292
Encrypted:	false
SSDEEP:	384:2yGYUA/PAByyR//QZrOGPqkaCNoKKf8fgC0gu4xkC:fCyk0OZkVoKK0fgSu4eC
MD5:	02953A4AE4DFBAAFA0D89A822202F51D
SHA1:	3CF918EB21DFA797F8D2A60BE18AC1A4C263A14E
SHA-256:	679000ECB5FBDD052A0AA98F42E81686953A1F3D5EB23BBB8C3C3374E7C25F35
SHA-512:	D9620BF79DF85B444412670064D62DC2A5F9560D5876093E9AB852BD40926B6A81EE076B27803D2A095849DFE58FBD7F8C9F6512DF714708AB1E1F7731B65BC5
Malicious:	false
Preview:	.......K.4!.>.......HJO......s.2..t#..Q.$ ...R'<.92d.D...! rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{14886bbd-e028-422e-85e7-A}-.......a2.u..DQS........d..}....d-....-v...d.V..jZ....\|>ts:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/6.T...2.YT...!...M....F......w..u....vlR.M.>....R'[..2v.U..-}h:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Publisher2021R_Retail2P.%.....3.=..'..[VO.TV.......x..{...$]V....>....`..&.p...+"hopertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3..>~...O.DKh\|.:..AX..TVx......u.."....2iV.P.r....I!,.<)%.r.X+,z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlEx'>Na..6._Bz..e..e\b.9Yl......W.. ...%

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021R_Trial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11487
Entropy (8bit):	7.107890686119928
Encrypted:	false
SSDEEP:	192:uknjxxQWHsKa9gpPOj3fihfpQEXMrbdH7RjlMJ4Cm:umjxOsay4jMfpKR9jlMJ4Cm
MD5:	4C7BC6757464E53CCA865ABF2C284D12
SHA1:	FC7122844B828B51C67D5185B2351CFFF3B212C5
SHA-256:	E58324E4DD4112DC5289C87A94C115A205FFB7245C7EBE92F95A49A93B99FEBD
SHA-512:	FB50BF208E4CD5FE1038C4BF61D66FA11F49AB3630A9DF78517D9C31D3CC2091B2829CE5F514F93E1BAC6308144D3C7838507EB14569CF61A9A7D126A412E518
Malicious:	false
Preview:	.bC.T..Tn>.$.zW.....G.HH.......%s\....gN.....<.g.I0.H..NV......rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{a6168e32-0093-4a37-9859-...^M..z~.`.1...@..MI......F..}6.....w@...E.j.5.u.="<!.h.......s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/5...3..t\|g...e.......S.A.C.....}q..A..'.K....7.H.D&.\|.Y.v....../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ........l.8.zV........B.<..B.."7F. ..e.C....5.&.N..M..^B.......gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200A...D..T;.1.1.......C>L....@..\|$E....?5D.."...0.r..g..Wb......rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV.....M?z.;.i.........j.......Yfy....u.

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021R_Trial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25746
Entropy (8bit):	6.604813227248561
Encrypted:	false
SSDEEP:	384:OptzROnJ+N8Mti+1OUVMEjvveCNasubRpcePcymVVSFgwiocbI5QM5A1BlaTnS1R:UMnsNztVVpveShIRpZKfDbxM5AfjBci/
MD5:	FCBADB28DAF573534FE9113DBAB86B3C
SHA1:	B764C54615D76477F319DB2B20FE28EF91D4B3C7
SHA-256:	B9ADA37BAA712BD0C517B6B3DB01A5D1EC3B05AE0DEA7E20A772F79792E3ED9C
SHA-512:	2348982AC0EBD4C9D97BBBA2483526E5C11304F0B05C1B89E6FD6879DF8DE45E3F122E3A3687E097D53144D5060908645ADAF212F85D061F0447D9BD705DA122
Malicious:	false
Preview:	.z..5b...^"d....@.;.)~i.(.M.......'c.lW.z.nK..&Uo..a....a.Ad:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{3380ff57-a57f-1328-f4b1-961bae2c1870}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x-...0w......&{.....Y~.}8.\|..}....=..]q....n.a@..0.@.{.\E.l.D}.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeCCE34DDB-C807-45D8-B5FF-F60BF....;)....a"h..O.R.k.8y~.)..?....M.9/.jD.f8i../Op..k.WOR%.Po15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X2..%N......o..U..u}.4}f.?..%...^..r+.=L.d.~A..m.x.GK.aPl1..8/TM/v2" value="Office21Publisher2021R_Trial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://7..gs.....Yeh....<q6.>]F.c.ob...MJ.?,.9J...t...sI8..5.^.[1.Gs><sl:policyInt name="office-81DD86EC-5F1C-4DDE-9211-98AF184EAD47">1</sl:policyInt><sl:policyInt name="office-81DD86EC-5F1C-4DDE-y.'+.....h.O...._.6. z. .@4...MJ.?,

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021R_Trial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11945
Entropy (8bit):	7.026192473733372
Encrypted:	false
SSDEEP:	192:b8l2AtTu5HS4Va3GbIAZMUleheGMH4Ov/m6jT138ud8qazE:oIaa5y4V7IA9lehe5z1j5sud8lzE
MD5:	20D09440CC20AE77D505E82206CADD9B
SHA1:	650CF98489F2861760A6B1D2EDE30D1E4163F7F7
SHA-256:	56CE619C6FD068F8B65CB51A1222DE575FB8C2B5E220E87578F38B7047592487
SHA-512:	96387A5175B121367B0D7CA81AACB2F0348925891B66C401441A84A02F4DDF6C2F9DB01D25E7C6CC861028BE8022068727BBE727209615CD2D058C0003600CFD
Malicious:	false
Preview:	,Y..64L.\k.I.._x...f..n581..5.=9._38....<7sfx..zQ(..(...F}.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8f057302-c920-46c9-83d5-.O..wa...j.G....6...>...7df;&.Uz.+q.O=<..V.jn!.D.(.p...[E..Eb.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..0..<.l..Z.....\f....2....l:?5..r.{A.]ci...3;~ps.LmV%..kN.Z4.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Publisher2021R_Trial"]</.....#5e.Z\|.I...d... ..)fbj$.T/..x.]zg....5c2bf..Y.y..2...Xk.tyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/..M..~`..Gb.I...@d.....$f)3h../..x..2j..P..6sTY...Q...A....W.cYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZ..4..wrb.._.u../........H.1..Ho.bm..x

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021VL_KMS_Client_AE-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25978
Entropy (8bit):	6.6747334286602955
Encrypted:	false
SSDEEP:	384:W3DOGui43r7XgI+5YSp8dAC6wX9weePRWXrFcRBiOgqOiU1jYThJIZWeL:8+7UDaSYA2X9EjtViz
MD5:	4DDF08B531407008C0A6EF19F42EFD76
SHA1:	FFC7278B5ABEEFA3420FADC2379B268122D6FA0B
SHA-256:	8B92FA4B6ED6F6F900F135AFC5E64ECCF542A151C8B461F6DA76C9C6B7A79977
SHA-512:	D52C02AEFBC1DFE9FA127B7B959F8746CB4D36728569FE8720F565D6B2264D211E0A54E1D4D2003D7B59BB8381323DBE0B507E7FC6A65267E7F04D929A2143A4
Malicious:	false
Preview:	.......f>N...IKo.n..Z......M.!R...E.a\|...]N...m...G=.hy.8...~.#:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d578577a-b829-4b87-6655-8c2b25620090}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x{k3....7<M...MTd.v......R..^u....t.a....2....b...Qq.'}.?...s.:.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeAA66521F-2370-4AD8-A2BB-C095E%Bi....*Nh...IGd.?..E.....LSsG...P.8z.Y.[]...j..N'.p\|.u..:..(15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/XdJ.....%h..E@h.%..#.....ZPm].....c3.]..U...}....~.h:......./TM/v2" value="Office21Publisher2021VL_KMS_Client_AE"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl+%5....%1O..MMb.#........m?.....}.c....S..A.b..Kr.la.u...`..!:priority><sl:policyInt name="office-81DD86EC-5F1C-4DDE-9211-98AF184EAD47">1</sl:policyInt><sl:policyInt name="office-81DD86EC-5P6....O3....9....^...W..\s....A. -.S

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021VL_KMS_Client_AE-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11980
Entropy (8bit):	7.024732325401452
Encrypted:	false
SSDEEP:	192:Qw8UoAgRdtexVVxIy/Lr++PENJFpC1KErV6H6q6urD:z8D/RIVVxIyTalNxC17V6H/
MD5:	FCE50ABEC6DD0955A3447750F4C04CB2
SHA1:	9693C2554603D238664D561318087D02E3F179A8
SHA-256:	1D24F2C8C8EFAFD513C863327661C83C4E6E0F687B3972F82E8A809461EAFAEF
SHA-512:	DC5C6B3BE254269930C6414357436EDF1C3D109A28D064B3D702EB857B6C477DD8D19AF27D585994BE41A9ACC1F8BDAE662C9A18CF49BCFCB57A8D9550D353EF
Malicious:	false
Preview:	.c.......~..H.8'.)g.?.v.[Xk.)jX:...M..f.'.v..w.}]...+....$....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{3312c29e-913b-465c-b0e6-C7.E.X....}.....w.v:.n...MEa.}........b.e....%.Ak.l..F...i.\|..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/c]...."...O.W.t$.js.t....xi..n.8.Z.5...7Zu.%..z.v....&...uEc.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Publisher2021VL_KMS_ClieI{.a.O2...!..y.:_.h;.n.z.V.3.57.w......b^:....4.r\. .!V...9.u..<r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://wwP!........+....o5.u%.n.t...3..L.}.=.....du:.9..g..o.w......#. ..1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsv].e.8..c.T...}X.*..R.p.ud<..@'K.3."...

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021VL_KMS_Client_AE-ul.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9969
Entropy (8bit):	7.083388257791931
Encrypted:	false
SSDEEP:	96:90jzmsv0oOgRAeQJDRECmKpeCXZOMQblv0aY9OsudfDf7UPYu3WqZ8AakzYxR0t8:i9t16dECcMKI9OTf7UwumUzW0tIqW
MD5:	B79E6BB080FA13048E780FCBAC2940E3
SHA1:	46F5427293A2A34485D4526D9E047F4ED89B58D3
SHA-256:	0E9F36E471BF75EA947CC6C619A93384F62C190D41CB74390472A39F694343AB
SHA-512:	43ECB54331119597DB76A969DAABF0B7FA5B3E552675C725CF025049A1B3B0D6372B148276FB8414E7079ADD2A76E9D76F376634E883893D2FA729F793728B0E
Malicious:	false
Preview:	h.~.+.YB.J.......6...\D....PF~....g...(cB.../m.....>5.q.6.....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{86424566-a51c-4ebf-96fa-.{..%.Q.j.........iV.......EiU.\.q^..&gL..y4Db......O.lP...Ys:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.L..L.yb<./...B..u....M...._AzU.T.!n..a2....cH.,....lr.t."...U.r:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Publisher2021VL_KMS_C.w..`.uk,aGH....k`...D..W.%..\.nI..{cB...,v4#.O..>..l.sR...^d"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http:/.i..:...aN.H...P..>....E......%b.'.dB..{(....,`.#.....3.v.&.>..Y1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0.L..F.qV[N,=..T..,g.-F...t{v.+.R...U

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021VL_MAK_AE-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10979
Entropy (8bit):	7.189913442122805
Encrypted:	false
SSDEEP:	192:PZREjmQmMieXhz9nCbjotvcdt9BeBei8K+:PTMaMieRzFtvc13Q+
MD5:	0DCD1E1644255E086268C883817F13BC
SHA1:	836039808BBD2BF90BE59E22FEEB762C8A83EB41
SHA-256:	81F8E58C09093D7EF00197E4AA7C459E1F84E4CBEBF2703BBEB801997B35D3BF
SHA-512:	9008D3483C540A15268F1D7DB90A372D5B2FD948F00D1BF496262454BF6540BD13DEE876BA6869C6013DA15B99E317C672A0E25DC4C85860E6BD08F1D6EA496C
Malicious:	false
Preview:	Z.t..........W. .G..._.9.o....B6...J......g...0n.&......}Drg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{99006d69-7c6f-4824-b2f2-."....^..=...6......./.e..../...D.....5.............b.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.A........!@AH.l.Y.....V.d.m......s.....O.....H...;Z.i......'B/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .r.........c.W.).[.....U...g....R;...T....b...L.........b.s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b.X.`.....EZ>J...+....N...N....E'..,g......3...2c.+....../PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4.r.....l..J...,......J...<.....}s...Z

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021VL_MAK_AE-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25913
Entropy (8bit):	6.601651492489933
Encrypted:	false
SSDEEP:	384:S3LF+qQmAOWtiVO6UbNOr39ciPc71uPyK57j3ZPyRTXpmfEweLFUKR2qqXm3sc:YF+Dzdh+D8RT5h5Jd23c
MD5:	7D7EC45B931C857D23AF29FE882E6D74
SHA1:	886924A0900A2D48DDBC642FF58FA60C57B748F6
SHA-256:	60765973CB5FF3D938A67114C28554CB8EF1F2F04A53737269FB5378C17E8660
SHA-512:	D5A2BD27A642CD00DF01BBB2A9761F26C52A0B6FACD0407825B7C82C8667D69D6811E125C80F98E462CE3ED42D86EB7FC8836CA0F2471017B4AC85D0D25942E9
Malicious:	false
Preview:	....Y..~h{.sx..TKN.o.O@..3.'P.h..h.WP.....+.@.2.GQUYM.G.l.&..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{04c0ed3f-57de-0981-ab02-263f686ad583}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xFW.N.L..\|kl.:\|...S..:.]..lA}.Dd..Y.W%..ki.1.D.9..G....].&..+...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeA0234CFE-99BD-4586-A812-4F296..A~..G..NZ.Lx......p.UQ..0.p..o..}..V..I..a.`.i.GXOFU.MG-..b..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/XYv>..u:.(,<.<t........O]..2.s..!..&.U....W.r.F.8.@..NM.m+...v.../TM/v2" value="Office21Publisher2021VL_MAK_AE"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:...J....=lq.ow........"....=\|.'.....DT..J.x.[.#...E...Z.l..m..ty><sl:policyInt name="office-81DD86EC-5F1C-4DDE-9211-98AF184EAD47">1</sl:policyInt><sl:policyInt name="office-81DD86EC-5F1C-4DDn.K...Z.f_X.8%..-]H.a.S...f.!R.6..r.DT.

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021VL_MAK_AE-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11947
Entropy (8bit):	7.079539267605331
Encrypted:	false
SSDEEP:	192:mVX1C/FQk8euuOAaGOsUVn4M/SGbP4idUyskN4ODGv8P9Z:mVX1C/FQk8C6yUX/5bAidUyXDtP9Z
MD5:	21C64DC6441CA82871894CC8CBFBA620
SHA1:	AC4948684FA2CB8ED3D702F8178C01C1357E87BC
SHA-256:	1B8A14B6A33784306FD284C9DF3516325F4841DEEECE2EDAED748197B6D4C66B
SHA-512:	C413C01DE17FF943DFBFEEDDDD000A4D99A6AC1997508999DBCA06B3A7F1C975E64F994542E271A79385D825774A362B57870EEB7CDCF0A5A75A3EB5FD71CC4A
Malicious:	false
Preview:	.5...\|.v..FJyN@-T.li..5.....4r..Q.`.....um..\...E.M.....0...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{1b277d88-e20a-46de-8b76-..8..b...[w..;.J34..m.J...gq.H..y......{/......s '.....}....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/5.C..v.V..wu%Q.aW./}.a.....;u.HS.%...+?.@S....DZ.....a....itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Publisher2021VL_MAK_AE"]M.\|..j.w.[HxB\0.I3y..g....51p....r......?~.gQ....W.z......g....ertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.or..<..4...[UfC\...y..F.#.."<p.HM.Y.....ws.@....a#`........C.YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr&.]l.0.#..Q.[@`..d....P...,.^.J).n....

C:\Program Files\Microsoft Office\root\Licenses16\Publisher2021VL_MAK_AE-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20291
Entropy (8bit):	7.201692174341118
Encrypted:	false
SSDEEP:	384:NSGW2C7EKLnyDV+2yvQsg8//riFWCFyyDsWQN3cgrV:/aEWyDV+28/ziFWyAb7V
MD5:	C033395CF7BEC990CB7F5FDA458D3F03
SHA1:	B9D15F12AB2157BDD037AE8658D3D9DFEA0E1A2A
SHA-256:	C9D43882F3E360E36DA9A71BBA09978C85885E51E78CBF560E747760D2790743
SHA-512:	E35D330AE554F0B7F93130EA8C2FDF179BE2C367C8EDBEACA0C372801530FE15DFD77E2F258884E4155071D1F803A91D9958D492C7193FD6B811879548407373
Malicious:	false
Preview:	....[.S.Z...!.2.Kn.b$........Z....{......w....QQ..S.....9R.i.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{9a3729f5-0f4d-4c58-8713-oT..W....j../.}.. .?..TW....M.:..m\C....5......9?..(.c..j..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.`..<.s.Hw.=}.o.Hp.v`.X.......^.}.W=lh.V.k....QQ..4D....(\.;..:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Publisher2021VL_MAK_AE~o...._."5.5./..?.#z..E......Q.c..'_K..R.%...SY...u........=..opertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.3@U.V...Uh._.1..%.o6..8....\.(.X!tK..R.v....C..C#..W....N.z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlEx.@e.7.w.Na.2 ...9...Y..,...~...<.C...

C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25689
Entropy (8bit):	6.666344171549451
Encrypted:	false
SSDEEP:	384:FYMoW0veD4hbiTID6seUaNhgDoKRVYoc58uCaRZCyzUliIwYoHur5VjVsKAOBOyt:KxhYWOI/er22AyuHoOLjVv4CB
MD5:	1B49D17D73A7F65F125BD2F880066B1C
SHA1:	825D594D39A5C60EFDD75A4B91637F1AED379B49
SHA-256:	FD93EA57F5584A5101A631031D35F29189A129ADAC015452F5DBE5DA51612E83
SHA-512:	5B52016153C6299D4B506185FBC39EF5E04022BAA88AB42C9AD1279E0646E43900866077CB5398E8C4FD86D4324BABAB4BA24A118B080CC5B64A29B6C7FA28AD
Malicious:	false
Preview:	.. }Z.+.N[...Kq/....i.&.\|...._..%.................z..Xg.`*.1.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4f9934ad-1716-8613-1803-72ea8e888b9d}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xy\|.2_.>.LX..UOn$I.N.<.4.(..K......=U.l.........O...5.._-.r'.4..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office6CB2AFA8-FFFF-49FE-91CF-5FFBB$S..!...>}.#K}$@.F.v.<.{.....J..".wU..............b...&.;nA .15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/Xf].sJ.......SGz(Z.L...&......P. B6.V.........U.z..y...z=../TM/v2" value="Office16PublisherR_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www.yy.3..).......Z.c.{...4.A........<BiSH.............e..Y4.$6L0.:policyInt name="office-81DD86EC-5F1C-4DDE-9211-98AF184EAD47">1</sl:policyInt><sl:policyInt name="office-81DD86EC-5F1C-4DDE-92119!..#.~.+l.X. p..P.c.i.{.2.....<BiNM.

C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11928
Entropy (8bit):	7.0309987733650425
Encrypted:	false
SSDEEP:	192:bIrRqhLaPG3S3N6VjSMX3quQtx02lC7sh6UyGRiyt6Q9:bIrRqhG+q6QwqDtGqiyt6Q9
MD5:	512C64D71617545601018243D8CEF06F
SHA1:	4C71DF5EF7D5AD1729514F08200F1C5382FE68B6
SHA-256:	7F3B709A176ED7E2961A1344D53A9280910024244FC0E62A4AA52A061195F058
SHA-512:	9606D083A94A205136CE6130053843054B7842A6FB84600480310F2A4F2903BC20B347F2C38A4D23BCDEDC2EF09721C24793C2C71626162564AC0A31B1143D64
Malicious:	false
Preview:	...L_..a..1;.A...,+.h.H.l..n0.H3....=....11Lr5"....ufn...Org="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f2b495fb-1307-462d-bcc0-.1....W...2..zt.....ts.~.B.o...!)..l.......cypD.H....<#....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/aP...F.2..P.U.f.B....x".54J.k...*r.0G.PD.o....<'G!x5....67?....itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16PublisherR_Grace"]</r:an}o..D@...m..fh.......`".7...m...wd..y.^F.r...;0.?l.....%{q....ssessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000.2...Y^...c.Xfh./...m".nE..m...n7..J..\.'....<ePOa.....aGA.=..drxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI4.;....c...g.7.g.9....O..l!..-"...>.2a.P

C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10967
Entropy (8bit):	7.136877805519028
Encrypted:	false
SSDEEP:	192:Iy+FTXbaD81aTGeITK/MIhy4GtLwv2R0xEZl2uqekWex/LI:IyMA81aCH2VQLwv2iEZlLus
MD5:	80310281218AA2394F598EC0DC553D2A
SHA1:	25B78092768F257B7ED74B6343440644F4F64978
SHA-256:	7CE6833C0C9000A8AB87B0FCF188884CDF75E5122EF43EE74E94EA3ACBE08C0A
SHA-512:	5255F3312A609973F93F03B22E5C7DF73043FD27721E1877A42834D8F90F5316EC1137B741A4C3432EFA75C0E475343D26A311F79F4F44E0DA26498CAF7DB998
Malicious:	false
Preview:	.).....&,:..CZ;aX......0.\s.m.sF..aV(...H...7.Q..#.R.4.....D.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c0692ae4-59e5-4ce1-bb8c-..L.....6c=....-1.[..T..\|.V .z.6....>F&.....eIm.>I%e.......[.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..8..+.4u...\.wbFG.WN..;..^\|.i.q....,.{..F.....\............/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ........$86..C[2~D..Q...,..T$.x.:V..5.r..]...2...9..k.(....[.s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b..A...^.6oo..^E.s4r..E....}p.d..A..a_N...a...c.\|...._.\|...F.PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4..7....Po0...o7..b..}.....n.?.by...)G8

C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25694
Entropy (8bit):	6.673145557354113
Encrypted:	false
SSDEEP:	384:CpZXThg1UckTqRbm6MLONyzv1H6Wc5SuAyliA77w/wf4wIMSPfpVyKLa3oIa:C/WBKKCLgS/BvUFa
MD5:	91E06B94B171133ECF98E23337C16850
SHA1:	A47CE70F139D925CA6AAE313F70ADBCC4D997A32
SHA-256:	E98F266D6DED00EEB73F8C660D048958A6301F0C5153FB5D209AFDA1BE3C6C6E
SHA-512:	F840072C8CBBABE7F264A3AD17ECEE668C0495DE8CAACD399B95362D24D13B51EBAF9E887EE9499C0D995B4A1B0E79DA51B5D889F6D8EF700FE93F1A6C97F0D7
Malicious:	false
Preview:	O...........6..C.C...p4.\...R?E..A.m......... ..&kd...c.E..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d43555db-3a9e-4ee8-4db0-0eb99dd055ce}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..............)..[....$`......3J+.k.........i..c$`0...q.G...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office6BB0FF35-9392-4635-B209-642C3..6.....$.Z..:....Q...a3._..G8...I..s......[. ..9sa ...8K...15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..9....F.D..=.......m7.]..]v......8........'.1k'...._}../TM/v2" value="Office16PublisherR_OEM_Perp"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://w..[.........6..%. ...X.....C0EG.T..?......GW.c..-j24...,DD..<sl:policyInt name="office-81DD86EC-5F1C-4DDE-9211-98AF184EAD47">1</sl:policyInt><sl:policyInt name="office-81DD86EC-5F1C-4DDE-9..D....L.?..mC._.Q.../._...\|l.G.T..?.

C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11921
Entropy (8bit):	7.082346487699261
Encrypted:	false
SSDEEP:	192:LPdWhEJIUQU3/eSlr2VF3VKDbQEQBiT+Rguqi9ZnVAAdZ:DdW+OUQ4lrU3VKbkdmuJXAAD
MD5:	2646D2E656B5A498F0E6F83E21FA3461
SHA1:	CF41E00D129E4EE247D4BD980B5A3CFAB3C82A63
SHA-256:	0DD1039A6463135E37D63D6B70AA298DE6FB4C1A3D3FE23C3F581A19EC292027
SHA-512:	5E37AD9E0869172908C347BE5D0F3C55CF2DB9F6DD08675593CFDD228F2BE383625F5648B2302066354F076ED7640A61A8D9774742E8D4A186C57E45B44370BC
Malicious:	false
Preview:	gw...5...l..,.[.0..=6T]..n.X8....q...Q.9....1..N.I.w......E.&rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{096ab6e3-9b9b-4749-9b0a-..".(...x.."...`..`<..F.xbRk....>7.L..7....8.........._....F.rs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/....?...5..p..T3..)r....3_Z7....5l.\|%.i.Q.b..C...`........Y.hitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16PublisherR_OEM_Perp"]</r..).!..h..,.[.3..a<....a\|.m.^..v..EI.g.}..n..L.S.........N.hyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2..w..t..v..6..T3..@G=...l\|I4LX..`/.\..j.Z..S..z.T.B........r..YlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZS.s..f...K....v;^..VK4.C.NRl6(W..Rc.M..Q

C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20265
Entropy (8bit):	7.097329182610596
Encrypted:	false
SSDEEP:	384:mtjOio2tCEKvgY36yoHByTymwT/I2d/rK+kEyc:mtjUqyoP3d/rHkRc
MD5:	EDB2CE367B7BE06FB5D2FC41B795EF4A
SHA1:	E29D01B288EBB61E41FB1924C597DBF46E7C2C6F
SHA-256:	5EE1922212F77F6403B4F196CC2A595609A22BA14F636EC86CAE42F8A958B79D
SHA-512:	8C00D9F872F7B5538D6A0831492AFE5526D8D13F21B575C66C7606827B82436771903FB80285E028F1B4880F25E52B08E9F95145DF6CB01A03A26FE767357161
Malicious:	false
Preview:	."..>s2'6.{..9.E..+k...a..._w.=I?V.o..(.B..m..{s.xV......M.y..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{79eab6ba-9262-43aa-adc1-7.`.gooy$8..r.S..t6.YG9.....t.e.pO.'..&....;.3O0Q<......z..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/J.I.Yy..$&J..&...h..CKh...Pp.eK{.....g..^..M..{s.x1.....C.+E.:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16PublisherR_OEM_Perp"]<!.>.oS2'Sqn..#.B..$y.X.b....Z'LrQ,M...A7..B.Gl..<\|.mx....P.x..rtyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org!.4.1$or9qs..#.L.$y.y~O....Zl.>W.M.7.Xd..q..v..}J:w.......Y.m^.BcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWT.K.5?f`T{,....H..Iv.orF..tI.ZX0..{.Im

C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10959
Entropy (8bit):	7.120337719832198
Encrypted:	false
SSDEEP:	192:xIB81x82cAF/xsjgCwDr0AuFLtdtAELo8nYxAYTp4g+:rj8NANm0C8Zcx/AEL+xAYp4x
MD5:	9709FC9DC2A67A92C061F56027849F2B
SHA1:	1F3A0099A6BDE99ACB866933E1B21C567DC41B2C
SHA-256:	7AE0A2AB9C0139DAA1EE91C776B27B0F0ADC819393FAFDF8BB6C47016C9B4EB1
SHA-512:	7D85D793808D4BB46B4C06D109419304522F3639438C365D0B226A24AE42E27AAB77A4CEA47D550900376DCD1F5B5E91111D9DDEF600CA0F094D0D223C79CA17
Malicious:	false
Preview:	...,...!..._..i>2.Q]d.L9..Ri[..$..m..6..h-....Ki...ghnC...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{dab647db-1aa7-4136-a40a-n.. ..y........'ao...<.Z$.KQ~....2..}..t..>tTG..!H..).2#W...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..m?........@...w}&...m.....Um...b..-..,..cd)....~..72roF.J./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll (.R^...p..._..u33.I.n.n:.O.\|\.....+...x..m*.....ib..2u#W...s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b8..A..%....B....HP...u.d8(.r`4...,..d..}.3.R...F..._5_YV...PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4..b ..)........=X3.)Eq.y0Z.};.......\|.

C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25692
Entropy (8bit):	6.616011818027357
Encrypted:	false
SSDEEP:	384:nGbOk1KGbW16iNlo6wu6NOHG7AdtWv7ODc5SMuL2aj9bAcuJSQMipwIYWkSM95Z5:qf1Fqg9a6Adz36Hp/ZQmjG1Z
MD5:	0583CDA35367973B8D27005FC2491983
SHA1:	DAD076080D9A418636C30E9E52E33FE990E6323B
SHA-256:	77661D05C72B95E28E25CC1A920CD3933F8AEC4B72BB670DA1A90467DCCF865A
SHA-512:	9129670612A2697FAFA0A37CFC52C8E54EDCDE0B2793F11729A358A5B32B276E52075036D7B4E476214B560891F2624A1ABB4ECA7BA6769391CEAF47813C65A7
Malicious:	false
Preview:	.0g..l.X..x',.a..C.......Q.....a..+..."_%.q.<X!Vq..N/.W....`:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{a756942b-cf80-25af-a2f0-4d6f743b9d16}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x@...yLZ..dn(.jV..HR.........@..FN.+..R0u.e.3S<.g....T(......y.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office6E0C1D99-C72E-4968-BCB7-AB79E.....DQ(#.*.,.j_.........P.....fj.r...pY6.m.;.sVx..Db....[.k15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X_...L^.A.4h .fE..V~.....F.....d1.)...2.>.o.,R)Q:...Zd.....'.</TM/v2" value="Office16PublisherR_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www...r....i;(AKc.]`E.j....R..gg.v...n.#.#.o.s.g...I3.L..T.}l:policyInt name="office-81DD86EC-5F1C-4DDE-9211-98AF184EAD47">1</sl:policyInt><sl:policyInt name="office-81DD86EC-5F1C-4DDE-921......0IL6.N`rL1..]K[.V...L.....gg.v...

C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11913
Entropy (8bit):	7.082940607515245
Encrypted:	false
SSDEEP:	192:uChnOl3iLI9DfLQgaYmVY1a7aPu4/D2pbl1+qs19RwiBn:uChORn9DTQgKVca8C1+qs19RwiBn
MD5:	C62C1B877E9125E65B3871C3815342C8
SHA1:	5FE2AC356B3B77CD33A7A81B83BB6718492FAC2B
SHA-256:	2834E5CA42E695C99EA829691960D82D5E3EF48D221BAEC23D29DC8C08D13A64
SHA-512:	6DFA9D740973626FB2BEB6DB4B45307F2E69A24A796AC3E2612578FE1A7C5DFA9F62D344357DCF5248CB156549AEC9934358044092D9F83F5F8B21E3B1E28064
Malicious:	false
Preview:	..U-..$..3.F.<u._.............7......(.9..........K.Z.+.w..7.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{551a400d-540f-4f05-874e-.c.^+W.,.]a.HGsc...T.BM.L..u...o......8.=.N.vM.....!.m..X.:..(.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/tR.FJ....D....a9.A...XA....}..o.[..*.h\^.,.....\.W.h.&..~.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16PublisherR_Retail"]</r:a^X..W..:..%.Z.m'...A.Ct...i...x.....x.fS..g......0...d....=.ossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200./.P=..$..?..Gm'...l.Hc....%..n......K.1I&.& ....=.\|..q.C....kdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI.4.BP....$..w(.(.8.e..m.,..A...\.....`.

C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20257
Entropy (8bit):	7.156975905115101
Encrypted:	false
SSDEEP:	384:32OOyBoeOYR4yEkpYqqNqT0sNY1LU7yDIq42/bMUct:vBv9myEnT1L+yDIB4bdct
MD5:	93DEA4219A05582C0AC90108842C948F
SHA1:	47EF3632A8969932DF27FE7B3EDB8DD765CAD0D1
SHA-256:	20E6427BA6D41DF43EAFAAC13FC3F6FFBFCE80CC38BD5F4E24EA575C034ADED4
SHA-512:	F4C60B7EB8D06A0D29D0C39336791C4C006D309BE97AA5E42007EBB22339EAA37B8089C345DB063866FB8A1F66D1CE93B3AE8ED2017FF1C6B58EDD56D452C37A
Malicious:	false
Preview:	>.#8p.J.K..x._#..)...wz >.I.+.cm.P....p.....M 9.d.B.O.r&..A..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d2b31cae-2f30-4a02-9868-...fy...ZN..v..5.v..P/"l(.C.(.;(.I.LT.~.....yk.X-kpn.......~s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...+..j.YP..$..o..j.XJ#s+c'K.,.;o...\|..?...m 9.d.B}..r4.O..Eb:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16PublisherR_Retail"]</r...\".b....x._#..7..E8m.1...7.8 .e.E.........k;.z.C...ul.C..dyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2.+.......b..o..J.mh2f.<.X.{.. .Q.\@.#...I..`../s.f...V..(sYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZS..0v.e.Y..F.r...^.aa.'..}...$`...MI..

C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11471
Entropy (8bit):	7.133983047397602
Encrypted:	false
SSDEEP:	192:ZjEyLhWpmzBvslcbppmEpQ/ComEqJljva:Zo2Apm9klcVpfpQKopqzjva
MD5:	6BCD706B73B18DE9C7989215A119B53A
SHA1:	ACCAA02D0B0084CD5C7AB4A6A524BDC43C956F82
SHA-256:	1A89E176224F51E45DABA41E325A0C0769DE6139599686F774F1FE6127D67DDB
SHA-512:	AC39F4976705ABCB9FF0A0059705CBA8A68256BCA10B81598DCF5D5146DCB7B275045CD9326E0B6D4C953577C6A00E56DFEE2369DF58B5B9AD0200155A90BA13
Malicious:	false
Preview:	..$.i...i......`D.>.W..g.l..6'.......~......a.A...&......M>.x.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{87ff03da-a767-43ce-baa9-...a...q.D.....0..c....+.q..50....X_n...._.7&...'......g.gWs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/g......{.#....cZ.*....l.L..1#....mM>.....j6n...-.....W+;."./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll U...7..k.......X.?.O..{.o..d2.....QT\|.....h+....&.....Y(3.bWgPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200....y...-........5.[....e.f.../......M&....8.EO...)7.....F.%.IHrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvVP.......8.3...eM.Z.L..n.J.3.....\vl.

C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25741
Entropy (8bit):	6.616287105363823
Encrypted:	false
SSDEEP:	384:q5TEZETKEbk0/kAgPvpBbCNqRRf2Z78PcCPwQuYth4inSGj30i6cKcz2AnA+LxmR:pZOSV1vrbSEQZ2vthrnH3hiIAd
MD5:	35F0762F1E0E7E474071128D52C13225
SHA1:	C9929E04D529737C77F17697E13E28831776B8EC
SHA-256:	E6E271B05ADC92BF6A60D6B649041233A68C1AC0350953AE6BFBC026BE7EDD7C
SHA-512:	99563C0963B16E4024CDE7DEC77128385EF8084209266B59083FB5F0D3485B99148459A4B3A551B11B4F7B7C55DD7865877A39A7FDBFD9CED20A442663B356DB
Malicious:	false
Preview:	..D.......d.&...3%...,.!.!..aa..j.......-=+j2.w.....;...9t':mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{90676d44-5d82-5761-564e-403e6ee547d9}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..........x."...+y..P>.uB~O.56..M.......}'?n=.jI....!....;q>.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeFBD9E09F-6B81-4FFB-97EF-E8919.v.......6.&...bq..E6.&."..3t..m......>w7J5.%.....1...}e,15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.........(....x{..S,.". ..-n..o......6d5l".............J{/TM/v2" value="Office16PublisherR_Trial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www../........y.`...>L..{>..<a..-8..s......&9u3a.6.....:.....pu%:policyInt name="office-81DD86EC-5F1C-4DDE-9211-98AF184EAD47">1</sl:policyInt><sl:policyInt name="office-81DD86EC-5F1C-4DDE-9211.w.......".m...>g.Gc.&.76.{8..s.....

C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11925
Entropy (8bit):	7.066688422197335
Encrypted:	false
SSDEEP:	192:AcXnqmTH95CzwBYFDY3ks8a6ITVpfk4xCemnn5ki+/q:9q+H95HB+Ps8KbbxCZnnOdq
MD5:	D496BD459828144798088A26145503BF
SHA1:	EA8357643CC69842CDA3A53E002B2C32F1985B24
SHA-256:	79BCBB2AB8FC796B41E8C2EBDC7C6970712C146BA057C56792A87BEB5E1D58E9
SHA-512:	9C7D53F3AEC0D6613DFB1B1C8F4B4A923BF2EE46BE676712770D81F28E41B6AEB99613A11A5F1172EE2E1AF0BC2400933799A30E19E9891C2692290A660267CF
Malicious:	false
Preview:	..).g.`.f4..y.....kuG-c.1..f.^......}..b.6)..M..~......<A/....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{74bb45bd-380b-4f1d-98e7-.`g#.+.?.'5..2......a$.u/8,.@e...D....m..l.a ..R.H..1..O.b....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..K:.m.@.?...f....../>.$hs...a...OX......<..z..@..-........~...itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16PublisherR_Trial"]</r:an.=jP.o.i.c8........)..$3q,..g."..N......;.sr..G..3..X...l\0....ssessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000.`?:.r.h.y6........"..$x(`.7g........6...2D..@N.C..+..(`.....drxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI4.i-W.-.k.]2..C.....c.$.]*...'<Z......7.

C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	7576
Entropy (8bit):	7.1328858945535005
Encrypted:	false
SSDEEP:	96:QUm3KAtDO+3xKFAXgx1C4ltFSOMkR7fOSG773y8OD586XQyAmWk9z6DV39gGkeU:+Rht3YFGK1ltFSPqm973mC8zQEh
MD5:	6D33E7D4C54787D6FC11774A088B46B9
SHA1:	25C15DDE7C861CD5E4C4749969AB3631560C3798
SHA-256:	EE713F3646A3C796BBFD693540E6B657B00D9207D3B9BCD25194D49CB9E4C281
SHA-512:	7C2D6CE18C30B5372B8F6E817C1207926B64D85DA8AC62F3337B325A659B5C40E6EBFF515FF7838B7939164E76987B7F51093554AC0EF1098AA3F7C1AD240060
Malicious:	false
Preview:	.K.n.o..$......V..s[nA...x..O.../={...5..5.1......X.,W%g...n.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{2cf6ffec-be62-2af9-b29f-46c5ba72c371}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xx..!.z._&.....]../.;....)@U........{....Z..!.>....X...6Po/...k..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office041A06CB-C5B8-4772-809F-416D0&.Dd."FBT....]..'Iq....o........:5"....3.).6F.....@.&.d%....15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/Xg.9`.C?Mr......Q..-......w.....I..aty...d.+.!...W.X..vR:...P./TM/v2" value="Office16PublisherVL_KMS_Client"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http::..%.9..g......./Z.1..i=)...q..iyh...y.6.;........1H%e...n.ty><sl:policyInt name="office-81DD86EC-5F1C-4DDE-9211-98AF184EAD47">1</sl:policyInt><sl:policyInt name="office-81DD86EC-5F1C-4DDP.L`.&_S<....y..uW`R..wJ.I.^..5/h..

C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	11948
Entropy (8bit):	7.061051098881097
Encrypted:	false
SSDEEP:	192:JKAo9cQHJCFdhhIaKmVLpkXJy6tmYen1m:J9o9NpUZILa1k5WYen1m
MD5:	F2CF074DC41F68FFF2D60F3BD6436560
SHA1:	6F75747D578F687C18653307AE2079A9BC9A0C53
SHA-256:	1B3313F6055AA403A4C1FB164756A84C11D840CF7ACCEC458C9CEB82C7B08C41
SHA-512:	BFD004BD9A9964C29AAC4FC909400DDBB7FFA5AF162563D019F4A89621CCF84D8C84B93DD6AB5299D7BB9479184FA1E00D4F87CA594FF9675FE5C207411B86DA
Malicious:	false
Preview:	.!...RfB2.\|.'..Y...s.LD...cH..l...T.O.<..P.`R...._.QD45...H..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4a41bfc0-40ac-4085-a49e-M.g..N8.&.).)..O...........i...4B..B...8.O..6.....5.f..FP..K..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/0....XFb WM.{......gQ.....+aG..4.....;..m._{.o^....H.\]-v[..T..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16PublisherVL_KMS_Client"]H.&..DSC~=a.&..D...c.A....FM..mW..].6.."..E.mV.....h.Z.z)...T..ertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.or..f...$.+Wa.8..^.c.<7...Q@..4...]....q..v.:L.....r..C.$......YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr#..a..?.9:k....z.....(!...\_b..6.....N..

C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9937
Entropy (8bit):	7.055684992265989
Encrypted:	false
SSDEEP:	192:SueW57JS0D3qDplFRJmu6mpNFhnRMqtOv:Sueq53KpfZNbKPv
MD5:	880D1E6DEDEB70C3A5552F37AF9B3CFC
SHA1:	D6AAD872F6686CE31EF6E650D6E736E8441BD1D6
SHA-256:	0006313D06EE0D2AC0D394E09561A5719129E8FBDB41F8E053C8D285B1E20226
SHA-512:	A5AC435F451603B8F0F6427C142E5F753B9D079F99EE01869D06C744E329BA3140519A48F975B2B433B1B37B513D3CFF6FE71885D8338E592BAB01707091E5B4
Malicious:	false
Preview:	..V....b....+).1...dm_..q.......g.W\|.Qkp...-=W..u.+J.b....g . .rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{50389f34-a3ae-4b18-87d1-.3.[...o.X..%b.'..9g...=..$B....(.A4.Aet...$k..I.. .UT.\|.*4.?^s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.W.....B.N..w6.}...p)...zE.,....#....S"!F..rqr..~.=h.%).M.c/Mo.r:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16PublisherVL_KMS_Clien.'....o.9...8.-...#2..0..,.....,.Ck..&.F..a0L..v.s/.}..K.4p.i@ropertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.j.Y.>.N..w8.3...-~_.M(.......g..m..0;F..)=...l.&n.B....D}..I6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlE.P.i...G.U...2....).0..Y>..+....B.kb.\.

C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10951
Entropy (8bit):	7.119434684915121
Encrypted:	false
SSDEEP:	192:IckxyQngUGtJ+i/Y01I+WjBYuM2MCSRyik2xZkI7pGIZ:IByQgHtJ+4g+uBYuMBC6yCxZkRIZ
MD5:	829B2DA3234464F78162E79EF59E77D0
SHA1:	2278DEA1FFF03F80876E64B0253E0E6766A362A1
SHA-256:	30A87AFB0201F957DD380968B2785C3B8294E7EC62858D06DBB6715ACEB21356
SHA-512:	A4E8F16434679899DCB5E1A6C5288CCD9B45E1B4E79665F34C947EBB869FF2BCCDD9450986FB7DBA05E71892BC18A730538E11794A84BBE1AD2698BE64A9CC09
Malicious:	false
Preview:	O..`J_..~(l.5.c.........\|..GQ_...l....\|..l..&%..:..%.5#..Xr.!.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{ff7ebc0d-cfbd-4f07-9ba7-...>D...mg1.;.,....D..j.$.RH.B.u....r.......w.%..b..m..Y.f.>.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...s-U.lq].i.>..._.H..!6,HV[......./..v...o...,.<2.h...Yw.{./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .....J..\|<`.".b.....Y.Z..^.&..J.N.a...&."..! .Iu.*..!?...f.>.s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b....t..nk9...\|.......]..T..DqV.k.}.......'....q.4>..3.pk.4og.#.PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4...l.m...kf.$.V.........I.}Z~....)....l

C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	7511
Entropy (8bit):	7.121150656169587
Encrypted:	false
SSDEEP:	96:ahm3gtdOyAzntjN+LEA4LEoovUfQYGHKq2qCfN/ODXZnfe1wBS2hva5s4zxl+:5sOyAhB+LEA4LEu445RN2YuBSuSxl+
MD5:	71FCF0ACD970DB1BD372FAB6C1B9872F
SHA1:	86619D86A2EC06C51445C8E2CBDE9CE0AC0EA439
SHA-256:	9073BAE10AD18810EED81E468C5C6DF48542190507455977C8285195A7C22E7B
SHA-512:	71862FA041A501DF0CA9DD6A43B0222DD70DF89FB194011AD3C96CEA0DE6577AAF87F0869FD71CB53328132E141795F5819736517B544C2D25D262EB04765045
Malicious:	false
Preview:	U......(nt..c.iX.J.\|.... .U...\|8.._..~ .X.^...^.<.!..c..^.2^.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{27265fad-9071-28c3-609a-926fd2571faa}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..c@...ylw.c.vS.R."....t.....+4.-n...lP...J...C..d..y..L.0[..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeFCC1757B-5D5F-486A-87CF-C4D6D.>O..\.d.R.-\.eS...n...'.V...i?O.J....2r.K.B.....5.>..i.....vO.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.7A..;.k80.3,.b_...<...#.T.sq\......60.C.@...V.w.6..I..;..`./TM/v2" value="Office16PublisherVL_MAK"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www.m...\...0`a.`?.T{.0........L...'vDE[....(j......C.c.+.....].4@.policyInt name="office-81DD86EC-5F1C-4DDE-9211-98AF184EAD47">1</sl:policyInt><sl:policyInt name="office-81DD86EC-5F1C-4DDE-9211-.BLu.W...F.:2.7....h..-.s...'vDE[....8

C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11915
Entropy (8bit):	7.033046700992819
Encrypted:	false
SSDEEP:	192:ona6eU7vT5GwcgUfG2sEVu2HLXtiUHUXxBxMfr/XnqHX5:obeQ5GTgMGrM9tj0XLSDPnk5
MD5:	21A3F51632BD00322DF8CD05EE0170F9
SHA1:	2780E67EFDB6A966B6F2F9962BB4C2272C6EB38D
SHA-256:	3E69417EDBF6BEFB0119B1812A3E3D649E66DEAC54DD3D9FFCF65FA13093135C
SHA-512:	CD1C8CC450B078691CA01D7BA34BE06D691565B2796277EC53A5A079D8AC86AB34B5C6CDA85550E9877358A14476A70138E9BAFBE07ADC841E37F2D5864B0325
Malicious:	false
Preview:	...s.e;..:.....N.bl.%;...GR.)n.<J.puzZ@.ls.$..'..fG.x[j.B.O..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{9a46353a-37f5-411b-9c86-y..y.-0..z...RX.,3E/j....ZX.y.y..8jTD..;z.}......f. e....L..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.a.`lo...c....@..\|/.ap....gP..j.>.....x....G .(..,..q@.aB)..CS..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16PublisherVL_MAK"]</r:anX$_.7Do3.%....]R.&2DTu.....P.5H.r../.9....j9.$.w...E.b[/.[.q..sessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000/y..7Yq2.+... s..8OCx.....{.#\|.kL...$n.&..\..#.....hL.w...L5M..rxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI44p..=.L1./...4e....MZ.....L..0.zE.7%7.

C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20259
Entropy (8bit):	7.115854155792056
Encrypted:	false
SSDEEP:	384:zy+Kl0gGNbdh0pxT80vXEYK2O8VI8slsMy3BFy:Q09n0/vXEYK23VI8sl++
MD5:	0DDBE865F0D3EACC90595425B83CEB37
SHA1:	3104A1345CE3037125CFDBC4F8C9F96320DAE8FB
SHA-256:	8ACAC0E3BE8A88BDC0BC3D02BDBE8F1C0C5B99DD5B432B0E8FFEB8D34B160FAA
SHA-512:	781CC5771BD0F87D546399A12F98F65417BE63E99378E5B76BFA9A2F90EDFA89B9C8AB067381BFD585AF11A15D8530DBED23FDCA54D44ED396A9BB948D213654
Malicious:	false
Preview:	..qq{D.."...b..F...0Z.A.=.$Mz....~.;..w.m...(:i.%kQ....s.sirg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d28d6618-768e-4ed0-88f8-xa~.}6M.d...-..1....vh..KA>.\|.5....n.?.C .;....@~.\..{..g.l=s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..Ub.qd..{...?..a....z9Q..C.:.\|O>...\|.mC.u.M...(:is.TQ.D..6Q/!:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16PublisherVL_MAK"]</r:a..u!.{Y..'...3../M...O9X..WA5.k.c.....dA.-.`..."k2o%>T.G..m.y.ossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200pv(ta{D..'....3...6..X4X..G..}.c.....3[+xBV...w;Bb6M].R..].Y?kdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOItm!f.q.......^...:..V.v..H).OVv....6.

C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	7406
Entropy (8bit):	7.152180127849738
Encrypted:	false
SSDEEP:	96:1sVm3xEPyYnt8/Mch2JrzTTueCgkzh9o8O+P6Dv1UILeowgRArsC3AI7OS:aWxEKYnt8kCwPu1I+cTeo98sIR7OS
MD5:	8F1ADDB773F1E281D5B3C87041B08760
SHA1:	EFD94462D514C5E5C38EEE2D815D4CA994C2EC49
SHA-256:	51D44DB1C587D99B7FC0BAFBBFCAB5B4B7BA3782F1AAE0AD8C3B26B738BBBD80
SHA-512:	A3C6B377F126BEB0485E75D77B5C9D69F1489AA48F389A6026384713634B6F2CD8D560FBF089B3A51E1EBB014E239020259D4918EACC598E1E5FA518DDB0954D
Malicious:	false
Preview:	..FxN:....w..N>..a...5...m.k...P....l.................,..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{6fad6be5-9a7e-0be6-010f-5bee11efa90c}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xRC..}[/..k..Q5[.=.^.'.FA2.1.B.a..............f.W...........microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office9103F3CE-1084-447A-827E-D6097y.I9..b....%..B5R.5.../...n.<....E.P....j.........0.......A.h..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/XMb=Hhb....;..E9H.?.r.5...l.?..........=........i..........$./TM/v2" value="Office16SkypeServiceBypassR_PrepidBypass"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns.\.Ge^#.....V~Q.3.T.z..]a.o.6...\|.i.......M.V..z........iX./sl:priority><sl:policyInt name="office-E1AFBCD9-12F0-4FC0-9177-BFD3148AEC74">1</sl:policyInt><sl:policyInt name="office-E1AFBCD..@H..z..(...g......!.=6A.6.L..W.....

C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11833
Entropy (8bit):	7.100879798161968
Encrypted:	false
SSDEEP:	192:QdIiCqQXJBA6L8FHz/nSEZhVar8OkbdmsRu+TJivt8GQ7p:QdIb/Z/LGnVbQreRmilVXGap
MD5:	6B8BC6509EA41DBBA4FEE4774A85F0F3
SHA1:	F9A57DAE255DDD2BBB05D1281E02165AC8FCA664
SHA-256:	61915F13D10C1079BD0CCBA0ED043B7605FB5320AB35C2FCF6835F83109FB47B
SHA-512:	A1E602D4F13C042C67B4DDCA0E889B756E0225F2C96169B957DC9980371CC6D407B553A40B97EBA2DED0B9B52A73C2EA7D7863F76CA64BD245ADF8EEAFD721BE
Malicious:	false
Preview:	..Y...G.....\|..V.F.,U......g...V.z.()..I.C....?...qB.5.d=.W...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4c00d9c2-4aa7-45e0-9411-Vk...........3......}..O...d.\...lQw9..G...J.w...c.m2.g.C..Us:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/s...i.g......!..H.R.g...V...`.\...<a\+....h....).O.fE.,.'l....Oitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16SkypeServiceBypassR_Prep^?..A.Y......r....-.~.......7.....sFQg..I......6.O.WB.!.!x.Z..Rd"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http:/.,...........#..D.G.c.......7.k.b.yMFj.........6...Zq.v..-.l4.U1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0F...c.o.....Z..M..<$."%...Z...n.O.HH.

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25873
Entropy (8bit):	6.636112404258762
Encrypted:	false
SSDEEP:	384:cUKMNF3ZVGGcyhiqm9eue6cVv3ONHO/am3x6wc5MHuubeX9XAZe77AwWfCl6bFdW:2yzGGDVv+qLiR4bpTdlF1vm
MD5:	13918B63E85947D4F7FB421B016B6FBD
SHA1:	CDA9FA035B594746E78E9A45FDFAD8F7CFC85CA4
SHA-256:	A73CC3736F7D6A0F2DEC3205A0B5DB78373032133D5589F8C95FEB296544FAC5
SHA-512:	2ECCC9EF7825228D25DD5EE3845D1692CD90371B16CC405425F7294DD9B6438F0C5ED2E3FEE4E5F2BC51A650B802CECD4FAE6CF5DF7EA20C6B7421BA24AA5C85
Malicious:	false
Preview:	..F;...l...r..6..Z.Qm...R.....t.6w....a.......$..2.QC7.d.J.C#:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{3f1ab8db-964f-6c9b-ee08-9f5af2a99931}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x...t...=...n..)..B..8..^....(x..F.....\|J.{...m.w.UY0.,.G.F:.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office69632864-D608-472C-AD91-9B13E._.D... .4. ..:....Cr...U....js.1b..3...._.$..-.TIz.&...R(15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.+.5.../.V.>..=.........Q...p=.39...qB...y...#..%..i..9...}./TM/v2" value="Office19SkypeforBusiness2019R_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="...w...w...m..+.....s.......j..q,....}.T..,...8.>...t.*....=riority><sl:policyInt name="office-E1AFBCD9-12F0-4FC0-9177-BFD3148AEC74">1</sl:policyInt><sl:policyInt name="office-E1AFBCD9-12F.K.An..9.S.-.!...L.>...[....ts.,o..

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11983
Entropy (8bit):	7.088278250836095
Encrypted:	false
SSDEEP:	192:O0c2vlhD+YutkW3EgdP4XAeJxSsyL+pGmjoHMRGoJHT:O0c6b+B5EgCX7kypFji1iHT
MD5:	466C153EF5CC1377FBC44957E5B620E2
SHA1:	95A9F7B945847FA1AA0F1F890313D9D2162E056B
SHA-256:	08A9191306BF28E85164E6819175E387398CF6DB7FF76D16A4B77A6CE06DC656
SHA-512:	C8503C108C46EF487B38784E82209BE5BAE610F542DB76994689C0AFA0B81C6FA0A24B19CE0F78029762421DFF9B02313A87B2CC2FB5F0054FB640A29B6D5670
Malicious:	false
Preview:	.Z...:..h.....+l{3a.Ki..~.e.~..;..g..L..........i.\|.H.h7.}.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e0763eef-c58b-4d71-b089-...F.!._~....[=<5l<..1...t.f.&.H".D8..H....Q.......$.;.%#.b.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.....0)+z....Igoepu..=...\|.b.&.Cv.t..@._.........~.e...9t.4.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19SkypeforBusiness2019R_Gr.....~K.r....>=!+g<..&...h.m.1..#..-.I.O...K....K..h...ayW2.:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www...M.%KUx....T=<5f<..j....I.@.:..#.Da.b.Y.......v..^...4)'?.Iy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQR...w..>4.....97c.e........_.I.{.1..F..U

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11003
Entropy (8bit):	7.089064309521631
Encrypted:	false
SSDEEP:	192:eTHyfruQRY4AdgLE4+EmO4cObxcAM5QJrKC/V1OgacG:OyDBS4AazcO4cObxcwbK
MD5:	56DF43EB04F2D9675436B79672AB9D0F
SHA1:	355F63E5898EA9421E879850C635DC1C9046ED95
SHA-256:	AF91D0D2229B988B4B64ED7FBD4C49265CE6BEBE342E10529F457EEEAD94161B
SHA-512:	0600F4F8765BF86C7290F11CFECBF0A4EF9F885EA95A36B66D49831BA79D78A2CA3AA3638EC5D734082B43F4934BD438D3DEE9224C1D2418AFC8340A91A1002D
Malicious:	false
Preview:	.V.H....2%....d0...z..9...1./.%...{.n.&.l!a<$......\.....Q.l^)rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{43777a89-f33f-4fa1-a618-)....J.&k....+&...p...u.b.b.8.`...3.~."..vhj}.A..3k}.v.pD..oA}s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/].v[.... \|...9\|....>...2._.>.+.'.G....^q.v/57m.....5K.s.V.P.a.//r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll o.I:....01....e9...8..%.\|.f.:.l...9.(Wj."4a9#....4#W.:.V...oA}s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b...%.*.."f...{...}....~.2.&.I.....gkY.'.>g.......J.k.Q)f.O\BPKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4S.yD.3..Df....Q<....y.....v.,.}.4.O.&...

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25876
Entropy (8bit):	6.681040363548899
Encrypted:	false
SSDEEP:	384:fSBNIfH2A31Na/m6S7YsSN+tVHoEFJgEc5oTuGijP1PVNK1RhID0wUhGZs3pEm2g:SMdFNtc+HBOdPVwvLZF2lmWFW
MD5:	F9114E03CCF0228A66A30953AB203862
SHA1:	FD225D9E9D44C2F64C05817AE9A057AA45599554
SHA-256:	ED09C26DB031C1DA232BFBE7AC9A0FADB9D9C5401CA04E1C839034D11AC885EA
SHA-512:	60154DFC2B7A1201C04B8EB13C02A8D4F951C5744DA647EE9F8679D8D68F38AA2E4820825B73ABB0670403C32C12EE0752611F93B79889B3054815881E57AD80
Malicious:	false
Preview:	A.I..k....;...\|iT...6..r).\...J..@.BqM..qa.,........!W..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{41d11a2d-9b07-a3ed-7a46-01d3750a2d55}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x....~...r.... 7.......b.z%%.{...?..0..kY..z\|.:.J....B.,U...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeB639E55C-8F3E-47FE-9761-26C6A......D.........({K.....7.\|g..[..\L...Q;Q2.*3.%.......H.e...15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X......K....t...")-....!.b}`.Y.M....P.Y(S..{i.g......W.qo)./TM/v2" value="Office19SkypeforBusiness2019R_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl=.....)....%..."!........oMf.e.M{>.L..wR..d}.&......H.,Q..priority><sl:policyInt name="office-E1AFBCD9-12F0-4FC0-9177-BFD3148AEC74">1</sl:policyInt><sl:policyInt name="office-E1AFBCD9-12....6....e....y.%.....c.ofx.Y..A...

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11968
Entropy (8bit):	7.111182130294394
Encrypted:	false
SSDEEP:	192:q7PyqQPXmIm6hInVk9ncsUTtRZ//Y4TbR5qS4:qTyfPXpm6iVkncs8HpQcfqh
MD5:	D27E9E6C74F6F0D6BA74B5B55927C261
SHA1:	F56F48906A89C25FCAF0CFE53B253124D596AB2C
SHA-256:	FBDBF2DCD60EF48BB105A1C9A83009F3B47EE1A09609D832628116C04F078510
SHA-512:	EAA814A10B6C8AEDE50E33D6DA1187CD513306324F64C45FD669799E7056A8A5F96A4A0F744FEABAB9415D3D270B0449C8A6262115224492447B2B00016A2297
Malicious:	false
Preview:	m[3Ox5.r....<=.E.n.".Hw~,.........%.$Z...S.~........^A.79rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{35c7770c-ecb5-411d-a8b3-....tt./.Z..2v.S. M.../&`......G....5.*....A..B...(..I.U.(ms:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..\.?.R.L..`"...pQ6..#w'...........'..z....^.u........B...~witle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19SkypeforBusiness2019R_Re....e..1.Y...9.n.<Qi..>t,....B..R...u..wZ..QF.b...M...ZI.z?r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www...](?.1.S..`d...!Oh..08`...9..Y...9..wL......Q.........]...2aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQ....?.D.,..{m.i.~rk.'4Y....5.......].

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20312
Entropy (8bit):	7.209556361597617
Encrypted:	false
SSDEEP:	384:0YWVByF29znJUPyvuRLxPx4/63BwW7+3ymGsL9cpKTcSuzxia:0YEBL2yv8xPxq85aymGo9NhuzxX
MD5:	6E9D7B7EB14A327683FAD607DA00F1EF
SHA1:	F3D7785AE8CE5A2034306AA52C66CAA43B8DB86F
SHA-256:	1FFC9CB2028612E0539096266E786D31A1448382EC9B962A966339CFD1434975
SHA-512:	6F464462125C35D27C657492D23FDCC70A1BAF58611EAAD096F18494E5F4A8497027447E0A62274BA370790C70349A4FE0AE90AD6C753ABC4357FC6368A3EB9A
Malicious:	false
Preview:	....}.....Q%...j._...._..D.~W6.fo.K....{S.1.Ub9..l....4...0..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{488a4da5-3f01-47b1-be69-..p.wMD.....+..:....E....Y.-T!.# .].....].f..;k.Z...._.G..3.@s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/5.....<....ny..Xi...E_.V..d.qP2.d+.....-..3.ub9..l......x..Gb.\:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19SkypeforBusiness2019R_#.7.+.S...7...;...CS.I..E.+.#."u.l....7U.9.xg6.~....6...7..><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://w..m.qT......f.Jn...]R.S....+k.....{...{S.9.Lg/..s...*.w...0.\N1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qR......$...l..C\|...`Q.w..f.$....I.u....

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11515
Entropy (8bit):	7.135451222627005
Encrypted:	false
SSDEEP:	192:wbRxi6iY0WfNQOww5gjhXMioXA0ohdukfaS:wFxiSpgjhJoX9PUaS
MD5:	2FCC3DCE5A8F73242D1AA6EAA9BC5193
SHA1:	F9FC790938EE8F3A2DB8EF3F7E0A00CD8D195D6C
SHA-256:	3781AD26D6925F605ADD681A33C036BE7B4628E70DCF6D7ACA9E5200780DCCDB
SHA-512:	8BF8ADB0153763204016A82E28E1568E8FFA9D84AA2D324FD3C7A6E609A382DDD48279EC4AA517FC6EF28CE7B558AAA86EA207A235C55A6C6B7B9B79616C75DD
Malicious:	false
Preview:	..Rc'....MT;X...>.w=<....4...l/...X..S..9.............>..frg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{5f53d934-af4f-41ff-a490-.j.:z.G...WqV..n.(`6..S.).F.{w.L.NT...W..n....&..9..v.s..2s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...p@.?...e.....=.4)x........hw.G..a......7...........P.?.`/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .9..y....YX'O...!.z<~.....7.B.y(....]......?..........c.<...2gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200.w.f7...HX.....Q..Xi....>.@.dv...M.............!.....T.....-rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV.h.,`.7..u$m...;..Y{.........RS.&.GP...

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25925
Entropy (8bit):	6.6340757869147176
Encrypted:	false
SSDEEP:	384:lXgnJzx5k1TIHNu7A3qU+Pci6/dDUpAP2S92PcftEQhjF0ABqqK9uw/euW:MTkds53D2Ploj
MD5:	F210B269DE112071094BFF013BABDC30
SHA1:	192CF745BA2D6A37BDAD35BEB71DF6B781F91EAE
SHA-256:	771315DD6E22D6532F2C9E7CECB13CCFC444207B46261B913352C6FBDA299C8F
SHA-512:	DA07D60D079DCCD0BE95AE39B66D98C2248E67F27E063F84ADDD9B18B6462111F10E15B901462A75BC376A6C8F96F190EA7A8198630922FAFBDAD8736BE6C7BE
Malicious:	false
Preview:	...3.U..r....;6.$..=...iSD/6..........(.r...p... .v1...[r.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{01bfc8de-4533-6347-b205-293db3f2a6a6}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x0.h.6.@.q.....a..zA./....=..x:.........x.f...m...o..q{.<.Yw..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office90BFBEDA-4F37-4D5E-8DA9-5EF0B..E.<.~..T...hg.6..'...h..:1U...S..].;.n$.Q"...8..;p.u..c.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X/.J.#.u..6.....r}.dm.=...~.. .F.....Y..3.l...x... ..WF.K.cL./TM/v2" value="Office19SkypeforBusiness2019R_Trial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="5.r.6....s.....u{.~..r....@.r:F~..k.....f.rW..w....4..5;.<.B:.riority><sl:policyInt name="office-E1AFBCD9-12F0-4FC0-9177-BFD3148AEC74">1</sl:policyInt><sl:policyInt name="office-E1AFBCD9-12Fm.2.O...3......7 .Ka.....1.Y$1B...D.@

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11980
Entropy (8bit):	7.0671409571117705
Encrypted:	false
SSDEEP:	192:ES7dHVuYadRPNse6v64PAgSVnKcZNg5Y1ESPoWkQaIa:EqHkNsesPAgaKcZNg5Y1EzWg
MD5:	B1B7F8E1C233ACB0745FD5DC73A81B23
SHA1:	737A91F0BEC9DF96D049EC12DC8A3CD1C99C435A
SHA-256:	5F564B900596DFFCD4EB28AB87C35191C238CBAB1674F460BA0681A76A961A1D
SHA-512:	E9F7C2554E6D6B22D6755BB51E9B8D5B2985F1D3B0171B1479FD78A3956A2BCC4939FF3548C0BFE0E6F5BCDCF6D316FC541539C08154A0F1D6968EF105361B75
Malicious:	false
Preview:	..............H..;.fc.L.f.......e..x.g..<.v .)...(...6.4brW,..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{eaac4d2f-43c2-43a5-a55a-\.8..@...B...i.u..l2....{.....H.\|..'.i..~..v.{..>..0.n.G8?C/..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/!kG.j.....!...3.%.."(..GMF.......(....7..n.%/.$.[e.../.w3#.0.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19SkypeforBusiness2019R_Tr.Xf.oK........bi.k..%(...O&.....n.}..2.>.... l.+.. .^.".ds{.\|.:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www...$.@.....E....i.u..?&...O[>.>..y.}..~....;.9?.&.M:.....~t.I..Iy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQR.\|r.@ ...A...ec.H..."..q@O(.7..w.S..."

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26077
Entropy (8bit):	6.692169114482908
Encrypted:	false
SSDEEP:	384:01XxUkAVw5+6kD2NaoAnBZGqqKc5h8uAiJao34jyd0fwM4WHnZ9kLDKsNQ5nu:EbQqi/SDGT5bSFu4
MD5:	FFD9DF569B37E1946EDA7685DB5DDF82
SHA1:	79D1C590F920B333382BB3F2A3A8FFCC6C50D347
SHA-256:	81781A463F81521EB3C3D4B26EC074D58D3D1B2565169B5DFB3586CB451E5256
SHA-512:	35945A2AF4503DC5602633513F3B713173A961AB97CF2D533E2C6BE37C347741F065029DE5C8D7C276CCC7BC01BAE961CEE0B7D9C029960FAD6F7FD9B0B0393F
Malicious:	false
Preview:	..4q7...A..........z.........?.&.....).b........NH..y.Q...G'U:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{939866c2-6b08-ca2b-3817-78b07d85cabc}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x4Z.>2...C..........$...G.._h.)....pS...Y...........c....E"L.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office734C6C6E-B0BA-4298-A891-67177kt..L...1#......E.h.......Y*.c.;.V.7.0..........TW..s......6^15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X+{..'...A......._.:......G0Dp.`..J\|.r........Y._..S.&...../TM/v2" value="Office19SkypeforBusiness2019VL_KMS_Client_AE"></editionId></tm:application><r:allConditions><sl:productPolicies x4Z.>2...C........A.z........K;_i...o.S...I.3...IRC..g....F,.200</sl:priority><sl:policyInt name="office-E1AFBCD9-12F0-4FC0-9177-BFD3148AEC74">1</sl:policyInt><sl:policyInt name="office-E1A.t..1...'C.......c..N... ..0.d...x.

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	12015
Entropy (8bit):	7.064497920732948
Encrypted:	false
SSDEEP:	192:Q37oHRGmX4V7xWXFxkgo6DoK3KvJHd4bY7aUkWed1ikxjEow4pds:Y7qGq2xKkgoI6xHd4bn3l1pxxs
MD5:	7F0801CCE38A3B481E72B4B032B5C930
SHA1:	A051CCE17E6CDFBE3A687445C28DED2321E4F057
SHA-256:	F15DD4092C3130FBFE472D5B7C778AF2D470685E8C7D6CA40D1B0E97515E5F8E
SHA-512:	801D97BE345CF9A4FF91D91A2E5653E9844B3B43FECD0F9FB25B46E321912C3B6FF11564DC18E8E4ED94EC77689020B0E4B74F487A93672871F685AB243E390C
Malicious:	false
Preview:	.r6.X...qNf..d.J.xG..y.,OL.N.....)20.`.U.......\|..$.:b(...6..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{27c59222-53cd-404b-ac88-l...S..0\b../V\.6...(.t.Z.DT...0$xCp.Q....C...J...b\[..5..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/....?...c.W..{D..f..N2.%D..L.....dtHhb..C......./..#.#{k...*..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19SkypeforBusiness2019VL_K...a....%gB..PJ..`..b6..Y_.O....a{o.$..`..E...}..:.9sz...=..appid"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="ht)...H....O0......jF..k.fYB.N....a.Ne...w........k..#.q~I.....WOjn1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8.........TF..!~..?..b..S..M!....n.Xi..

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10004
Entropy (8bit):	7.13029460498983
Encrypted:	false
SSDEEP:	192:dvGXSu/98CWIaKug743w9uRT3LzFPN3piBR31F3:d+i+WIaKx743PVLzFPdMBl
MD5:	4D367EFC2901C41D07C9AD932826914A
SHA1:	492EB60CA35D5789CA1ECF39288C2454D6591A41
SHA-256:	EF2BE893EBB499E90377E702F840571CD2144E8C7910E13E7D08BE0ED8F8B4DD
SHA-512:	008EA614B376D040BAD76FCB859EED207E7DC7608FA89AE8C9B3C0E4C9AB8530E0FB234136CCA7040D32141FFEDFAFF9DBABF48E7EEF8B38C120EF710A2AED81
Malicious:	false
Preview:	MVH._{.....q....^%..3....dc.+..v!(e...q...H.4g;.......?....v.Y.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{ba806cbe-92ab-442f-925e-.....Bt....._....z.b...yi.(.Y3n1sI^......b>i....c.<g....b.F.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...U[.....-....@f..x..NDa.,.Ytee#yu.8...B.xB1....+.L.....y...r:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19SkypeforBusiness2019V...xU...]<..@;.p...N..7.O'=3m...<..].4bf....!.%&....h.K.e="appid"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns=......9.....uN....;..!..I$..).O=3.!.......V.9b-....!..&....[...XhcWOjn1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW....U&.....n8...+N..X..[Iu...s.7.N....

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11007
Entropy (8bit):	7.0958186063275335
Encrypted:	false
SSDEEP:	192:UQkjQ4DWznl0tT81pdjEUebP6RqPGzfO0oCv:U/6zl0tT44+t4Cv
MD5:	FE871B0D2B023301C01E615B500705C2
SHA1:	F9ECEFB4EBE4DE8FC1F37185A09AA50A9E37F80D
SHA-256:	BEEE7712E0B34E7368D2BEC5D0D055133E274A92FB37614D4C805732948F4520
SHA-512:	61E9ED8788DAA22350EC2CDB433C670CDE0820DDA50B1A12B0C4B52EE40D3F096F283E87BB775EE75B2EDBD8EBB4744139C9B56FAD28FEC9B0BB6372C9C79532
Malicious:	false
Preview:	:-..$s'...d.O..sj......Kq...@..U...5.4uu...-..5 .g.3..n#..)....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4bc5e59d-4add-4d93-af17-..Z.z?rU..8.A..e:1]T....=.........#.ke{..z..lrX[7.`.Y{..d...Ds:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..$.Cy.*.U....?iaA.]..BzX..O......s.y5&..#..\|..j.8>.!~...(..../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ....zf/[..h.X..zuc..[..Am'....R...`3/..8..2%.7N.(.W7...d...Ds="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b..].}Xr..1.l..Sx.tk...ZK-.6C..:..=.4\|.......t.J.1..cf.......{PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4..+.pA,...n.^....+d...^N0.D]........\|de

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	26012
Entropy (8bit):	6.6308444168405964
Encrypted:	false
SSDEEP:	384:zvMlGUTIq/8iRIYBcyNB3h10e+QKWysU6eel06vLhpzTM06R+hZ5ZWPC/9EjaEIT:r/UTIuicj/KWykPCq5OvQwxPyC1m
MD5:	3904BFE90C2886ED2736D3F4F9E16763
SHA1:	67760618D56DC6A4D2E73C5303B5B3C08E6E42F5
SHA-256:	720F1331698461C64CEA87F68D6FD0F3218FFB6894A806C40A463452261D09B6
SHA-512:	9B3B82995F516654DAFEEC7D90C63E0A542B67157ADA8D8B7D2522908127F005703870B559E53A24B14981EEC8A7A1C58298C47D08A2987EFD8C3EA48411421A
Malicious:	false
Preview:	{.......!...s..j'#t....Sy...KM.L>.\...#v..eYk.RV.^..O.=.$...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{759fc8e7-6a08-aee3-927c-0620e1daad64}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..nW....#...:..a};(.{...-..I...@1.m.....S...q]d.O....K.:..6'....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office15A430D4-5E3F-4E6D-8A0A-14BF3..Ea.6..Q...L..atr .1..B~......K{.I.....qp..yyl..V.D..J.p...n...15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..L..!..w..<..mnh.W..Nz.......h.......3'..{_{.ZQ.........Az../TM/v2" value="Office19SkypeforBusiness2019VL_MAK_AE"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl..hP...........ghn6.x..Ux.=pn.)n.d....kx..5Cd.LW....W.p..)4...:priority><sl:policyInt name="office-E1AFBCD9-12F0-4FC0-9177-BFD3148AEC74">1</sl:policyInt><sl:policyInt name="office-E1AFBCD9-1..0..3..,...7..B^2t.&..u ..G....p.X.....

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11982
Entropy (8bit):	7.043329055704542
Encrypted:	false
SSDEEP:	192:7sN71OzO2r3QQ+2PU9sEVIWeHogqlHv5f1cCM44ymhop:7uMOm3t+wURVId9wHv5f1cCSC
MD5:	C44D2EF4331AE4B360FF507ED4D53813
SHA1:	2E516646F8BB6E75C6292819FC3A1D377431EB08
SHA-256:	8B65EF8252930C8A19940735233274EBC21A227B7A7B17789EE90C58341CCBA7
SHA-512:	71186A28F5131B6E79E902C55955D0464C08A3122FA0B21FE38CA02BC20575C0301DCD023FF3A61B30A05294A7F2AF0E93461F503F83F446005CF4F01915C2CD
Malicious:	false
Preview:	..~b..pl9...a..C..n.E...?..&.(..4\..av.Yc.#M..NA..F.Am.Q.*..}3rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f70774e5-cbdd-4247-9003-...o..\|d}.Q.o.UP..3....3)..u.?.N{E..>f.]m.tD.....o.`Z.o.p..bgs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/{.q..PL+.=.=......z....tb..).,..p....t..=.....CW...F`.H.{...4}itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19SkypeforBusiness2019VL_M~.....@<6.S.\|..Ax..2....~2.N`.u.F3i..gh.]9.66...R..m.^g..."...,7<r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://wwH..m..og6.Y.".....,....2~.N....L8~..,1.[.. ...^...J.DZ.B.....\|G1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsn....oWC.&.&.......(..S..A....zyp...3.

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20326
Entropy (8bit):	7.194848364153375
Encrypted:	false
SSDEEP:	384:vwyULj8NN2yTYLltKCswYQkHxSirygy0NoeLdlvFiPT:CcGy4fKLnsiy06+6T
MD5:	F4501E8040731EA473FC0D2B00BCA3E7
SHA1:	EDB77F6EB3B4870AE7AC6697638DBE0373D57CE4
SHA-256:	6BDA72E76951710E6EDF16A9E40C929B7402A6E250615465DAF60E10D7F13575
SHA-512:	84A112ECD28FCBD6DA35EC6BE8238B0B26ED2D97449779133CF585C71CE3B9EEA97370B08AAC2FF93E0030BD8C39CCABFDCF8A600C453123FFF647687CE8C992
Malicious:	false
Preview:	2R.....<.N.cOaP.-...7..L..Y...Gl.M..qmz.I.]S...A..^w...3...;..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{449cb57a-8ba7-47b7-862d-..?...e...#A*..}T..=H..G.D....)aT..}t.GD.Z..Z...w.8..1@...8..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..@........\.~......sR.E..y....nj....o5..._I...A..^.C.....Ui.:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19SkypeforBusiness2019VL..L....r...c.iQ.}T..wI.Z..Y.....t=V.%#{..N\....H..ZB%.....%.."><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://..z...?._.#.8.. ..jW.Z......)..\.(#0.KHw....Q..Wq...'{..3?..rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0q..\......o.BsA..)...5j.f(.t..?..j.....

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2021R_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25794
Entropy (8bit):	6.648781110884143
Encrypted:	false
SSDEEP:	384:7eo/nb54QAlGPRfwTePhf9T1reeESN1Hc1W9JJW2BMZRMr/sHWq1:7nKowCpN13fQAybIKD
MD5:	3B85A2137D9C611FF4817BF15F0A803D
SHA1:	E8F85367D1D033F0457B725C4421E272C8D5ACCD
SHA-256:	DA7B063A7561B29AE2971C9DAD010877EE1FE0E77A86EF3CE4FA3AFBEE7D9061
SHA-512:	8FCE454E1E2B16378A0BA77F010F5A8898E4DD233491239EC244DABBEDE0D00A14B3C7E41B80FB8FBA94A5E16818190993B21BB5FD5CB72F3513E86D69C5BA79
Malicious:	false
Preview:	~}.c..N.1..d.C..y/w.o.<.2.}..XM....m..h..$z<.....i.+Z....\7...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{79f24b80-7655-3a5e-9151-8578803d5f94}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x...,..[.3..xQG..#7+.:...f.".......G...K&........n......%....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeA781ED2C-DDFD-4465-B6F5-68523...m.[b.A..6'C..~#.p.&.5.~...X....e..v.."iv.*..`.4B..^..l....15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..m.7n.g.(WO..0d)...<.1.\|...B...$.=..uae.....".<Z..2..R.../TM/v2" value="Office21SkypeforBusiness2021R_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl=".../.L..f..{.I..7b .q.s.s.@..nX....X..<..&4u.Y...~.'N..P..%....riority><sl:policyInt name="office-E1AFBCD9-12F0-4FC0-9177-BFD3148AEC74">1</sl:policyInt><sl:policyInt name="office-E1AFBCD9-12F....S.. .;Zl._u9~...+.~.#.EF....b....

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2021R_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11983
Entropy (8bit):	7.092116205798766
Encrypted:	false
SSDEEP:	192:+gkfRDwLt/vkac6e+IqHtuARv0xMJuZoSfwjgmgJ7dxaVZ:qfRDotHPc6edqNpcx6u6owjYJHaVZ
MD5:	F43E9E471AB72A432D04F82B769E2A7B
SHA1:	98B47629FD634D770F311661CAEABDFA9492C7C2
SHA-256:	5B5BD579B1FCEF1BB85F88957A00BC799EB58018205235E260B93B3FC86DF510
SHA-512:	A19B715FED254DEC44AD0B584FBF532366115046DFBC9C094562419BBD07CF8DB73A04B304C6E956DA942106161CD252FB59ADF57E15557933562E747ADB97AB
Malicious:	false
Preview:	...v._!...n...P....<'..0..R#.%..Y....D..I..b..K(.q...h.b.<.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{a2e41fbc-bd93-4a72-b3f0-P..r........%..O....d.X.:..E{:j......J..@.F0...bB.F.+.2.v.#.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/$.pe.U.....q...N..h....2..V{}b..!.X\......o..y.?.\|...9.!.u.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21SkypeforBusiness2021R_Gr..Xh..c...k..R.....s,D..&..Zl.<.H.Q\......`..8C..<...y.,.s.:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www....%.@c.....>..O.....?`D....Pg.1.....z\.....Hm..oY7.}..~.\|.~.Iy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQR..E..p......,...#....^.)....f&......M

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2021R_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11003
Entropy (8bit):	7.145430062021346
Encrypted:	false
SSDEEP:	192:QmuVS/V9oiprNqetpMQ3YxXNp1nUlHW8q3I6pkPo:sQrNXXM+SV3fjKo
MD5:	21A6DB7F7ED87CB6A28E5A18E968445B
SHA1:	C7DF83DCA11405B982E1755906525310A5581669
SHA-256:	6102819664386B72FCEE0E7C32781F29538E38ECA718C5C67FE8BAFE6D2C6F65
SHA-512:	A68EC92A62DDEA73D22081C87E9E2AADF7AA5255DE8F9700C897CBB47AC843D5CB0DD84239CB2E9C701E4EE7A6ACA7136922FFD738EBB6676953019B12D6A754
Malicious:	false
Preview:	l.pL.^T...Lt..2.p.2.p!.......#.!....0.5.m.....,.q..CC;3h;.\g.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{1a4ea6e3-6fdc-46ea-8fcd-..........L7.}. .m.zp.....].4.d.... .1./V....d..X.t..@2v._x.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.._.Tt..}K..o.s.q.4j.......'.#...p.b.w.... .z.....fr:.Q=./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ..>.K\...@h..3.o.?.29.....Y.6.h...v.y.#.....&.._..zW'fuv._x.s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b...!.u...Q..-.b.D.wa...8..*.M....9.J.&(..1.s..N.sa_...e.PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4..@.l_..FA.....T.sY...J..q.0....!.

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2021R_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	DOS executable (COM, 0x8C-variant)
Category:	dropped
Size (bytes):	25797
Entropy (8bit):	6.624436206696266
Encrypted:	false
SSDEEP:	384:YVXvzeS5Zk4r9fpumQJV1a+5G5fRKeetWH8m47u7gVndWaz8hzrRbMECtYczmyoN:keUDZI/n7c5fZ8X71Je7LCecq
MD5:	239A21C6FA5973F8E60A456FFB3BEE08
SHA1:	16729ADF9F6AC6374D5ADFCAD774C8D09B2E6657
SHA-256:	5093325B567F13003FF4E8BE252171382E3ECDE4777DCC1914AE6672A3F09A0F
SHA-512:	91CEDA291082361B77660D60B60E9B4F9F46DE88FF4C07DCEC33993ACD7A26F052FEB3FBCCEA26623897775758E0EB0BE69E553A2B940275F4B88421B11A7DC6
Malicious:	false
Preview:	.JA-l..T+'N.G.e..Z..a.R.#;.>M.....u..\|..."...#...1_......>TNP.7:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{333b8e70-4cda-6911-822e-21730c0ac187}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x...bi...)$Y...z..BP.4.@.wj_j.NL..._....wr...,..V'.......vFCR...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeC3FB48B2-1FD4-4DC8-AF39-819ED%..%aN..[.o.x.i...X.~.H.$,.?.H....}A.b...1..6$...8E.....\|....<15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X...#\|"..}c....n...R...R. 4.).V.....<..)..I9...3...z.....c1.h2k/TM/v2" value="Office21SkypeforBusiness2021R_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl=A..e#L..\|&\.Y.i...R.%... w+.i[$....<f.q...n...z...;....\|UCV.cpriority><sl:policyInt name="office-E1AFBCD9-12F0-4FC0-9177-BFD3148AEC74">1</sl:policyInt><sl:policyInt name="office-E1AFBCD9-12%..%.5..2`....L..I....1.yzQk.[.....\.'.

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2021R_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11968
Entropy (8bit):	7.115144617221951
Encrypted:	false
SSDEEP:	192:xQM1z3EIlegE4PI6Ar9Wl/VhdJcZKKUbyOrNGLB7R:mmt64A6ArEdhdJccKk3EVR
MD5:	2C5240B9AC82DA565F210B1F476EA98C
SHA1:	C7C54B15073832339164A149FF00F395A6D14EBB
SHA-256:	012EFEAAAEEBE0F6D3401D13B562EC0707EE453C4F89F857F19B952A45493F54
SHA-512:	69D3D0EF5C59C47F37E4A69D00E90F5F811615C3E544D8195926C7E6B6918BF772025536C60BAE97403731DFA36D2B23CFCFA8D5F4615A992E691FAFC259FFA7
Malicious:	false
Preview:	....;M.~....o.u...@...5.......*.........0z/!...Zp8..y......mQrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{a852f579-a7f3-482c-aa5f-D...`..v...aV:.V....Tm.....Q.=N......4tmv.....L....N...P..r.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/6..\G.^..3.(.....Na..Z.....N.....a$}....L{k..t..L..$.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21SkypeforBusiness2021R_Re....&h.=....D.v.C....T\|..Z....+D......h)/...^l...+....... Wr:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www\..kG.=....3D#.C....Nr..Z.8..N......C)93....S_"...~......PZaIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQ ...QG.H....(M1.I. ..jv..7....x......

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2021R_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20312
Entropy (8bit):	7.238238700941813
Encrypted:	false
SSDEEP:	384:K1gjFM0bIePNIyiliaLH/hkBTS78sKiyktffLuzwF3OEbyHwUe:FD7eyY8DsTyUiz61
MD5:	EAFE1E9D033943C36D7EDF3F5EF30B31
SHA1:	32A582CA84A0E110307DC9561D58BF272C499705
SHA-256:	2D7D6964338A8FE36C6D37A2B542F35DB019220B9360B4F4809DE9C7181120D8
SHA-512:	D1A5C672D30924855BCF585AB3C074133FC1FA7F5EFBC5E3DDE3F475282C897029493D6462D2433527816EE5D8BB40D325DDADB9B8852DBC5CDEE10FC09DF096
Malicious:	false
Preview:	..?I....Y...O.e.A.z.(.....l<..K........=.......W1._f...9.Wa&rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c741f7de-8553-4bf6-93a6-._....U....A.*...%.".....fo......E...3......"~[.h>.Pt.T~rs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/5k.Z.(.K....8.B.9.l....n3.......n.D.n.......WV.`f..7..=n:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21SkypeforBusiness2021R_#\...G.E..].R...3.j.....6iQ.L....N...;.....@8.]v...$.Pv>><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://w.N............%.E.3.t....6i,.7....N.Q.=........s..GK.%..W#nN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qR.h...0.....u.>.W.9.I.....[f8.;....`.S

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2021R_Trial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11515
Entropy (8bit):	7.100226193068221
Encrypted:	false
SSDEEP:	192:iSg6f8mT8kVsaw9N2zwh/BsVtEshrBjj/:iSg+8Y8kOaolhJUyshrZL
MD5:	896FBACD0CC228930DDBF257AE2853C2
SHA1:	801F1FA69C0994D5287DA68F927AA81E14ACF1A6
SHA-256:	FF1510E18385D0F65C7AD0E9B00E8D8CA55E329493A7FF78268221456F35E114
SHA-512:	DAAC0FF4C8BD5964EFB06E2F4A6AD089E5F39E6D5B58EB8ED73324C3D9734A5A348595866909CBFB134EE49D3A837F29F7827CBC8BAE6352BAF2939F6D4F835B
Malicious:	false
Preview:	..........9..(.=..a.i..b.C.h\|XP.=.f..y9.u.q..Y..;).3...)..y.0rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4beec1cc-6f23-4415-9946-.^.....U.T...g.m...k.1........$...+.9..}7l".'......C.....s..z.ds:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/$i...).2..u.>..%.=...B.L.l$Z..{.+...v4{.z.U..0..\|...3..t.6/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .Z....X...%..)."...#./...a...}{.J...2..&w.s.x..H..;,./...=..c.dgPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200P.........,..y.R...4....h...`%.I.(.+..!_oE.U.....*..;..."..#.{rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV........."&..v.8..&.3..D.[.V.Mu."....

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2021R_Trial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25846
Entropy (8bit):	6.602217978599409
Encrypted:	false
SSDEEP:	384:8FsYYHsd6hgk06sAthrh5SdgeJ5sjKu5KeJvvty+62XTWUGCBWGyiE5Ur5nKdQhw:FYepIuhrh28JsWcpL6U5AEXg6
MD5:	B3FD8A72E39558D1196623FC437A9405
SHA1:	E7984B562E37DA6E3A68F0AA19EBADE6FB01BC5E
SHA-256:	A4116FDC280C554A5BB78A03B0EB5207DD7556F716280B484CEF2ADDEE19DDCE
SHA-512:	EAB9083BFA59D9382C2B80DAF6C77D738869E5A7806AA9CA8C21E3FBAA42517DE64367E5FECC9C80AAC550AAD732ACC72907BC16AA9D3BB1ACCBA71C791C0005
Malicious:	false
Preview:	..Y. .d...r.SXm..[.....!...l...F..3wKd8.S.....(..K...y...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f0f7bff0-e2c3-7ff2-450c-2f9dbaf40011}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xm<o..5.5...;.LS7.......\.Mu..L`...$F..!.$4".W...Cm..Q.Ub.t..f.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office5C3B11FD-D558-4ACE-BE41-8C2C2A.D!.k.(..M._S>........ ...k^......%Mwr.s.....7..A.^h.=.t15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/Xr.MW...'...=.X_$..........6...%M..GD..{g..a.U....L?.Va.hw.)..#/TM/v2" value="Office21SkypeforBusiness2021R_Trial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="h$u..w......h.NY#....T.I./....u..;'..>kIq.......F$.G...d.(..ariority><sl:policyInt name="office-E1AFBCD9-12F0-4FC0-9177-BFD3148AEC74">1</sl:policyInt><sl:policyInt name="office-E1AFBCD9-12F0}5#.h.1..04x.a....:..D.Ly..kI......b

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2021R_Trial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11980
Entropy (8bit):	7.015961102174429
Encrypted:	false
SSDEEP:	192:bXxKoglIc7FoC62s2uggJwMA+LsnMZiv0DkQ75ThB6G0ath9axVck:bGuezsfSpSKMEv0DkQ75TDn03VV
MD5:	5CC65EBBE75921D3C24720D2316A2AAE
SHA1:	B565D79B118F904FC8851571AFD4ADC39F6DC7B6
SHA-256:	A73E145BCA5D56E1539A485CC9E1188CDA9E054A5E7F36D8D5C33A3F0DB0F33E
SHA-512:	49AEEADE5E3923DA1C6ED4EAA25DB526AE363D68529463E322561AF1C953D9F90FDB5458CAD55938B855EA3681815AEEFF28C3754C373EC1208F072FA992640F
Malicious:	false
Preview:	..y.I]...B...V)~.'8/..2...._z..)......o..<..X..a..#@s..C...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{aac7e9c9-c783-4463-a2c2-b..v..S..V..P@y0Sz2~..~...Q\m.Lf..RN..k.lk.....].....M.M..\|..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/Cr.j.C}....}..B.`O3\|d.9.7..X~..n..be..>.\|...T.j....Yj.F.Ac..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21SkypeforBusiness2021R_TrnA.g......h..5@d.Xz{d.b.W.QWr.j0...[..>..7.G..A..nTs..JL/..:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.p...V......_@y0Yzaj..b..zx.}=..R...>.)7....f..../bL...._..Iy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRke...fj......2J&.ZFEn....>.&sN.s...Ps..

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2021VL_KMS_Client_AE-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25998
Entropy (8bit):	6.654115332899689
Encrypted:	false
SSDEEP:	384:3fNo9e5oB40IHs93QcTX/ZrsxqXTeek2+KpL9XsOkGLh7H2uWWN7Ev6q2KuwGI3j:bvsgeps0usXc4xKuy
MD5:	48E429DAC403768B415C666667717022
SHA1:	CABE43CB28509D6B27404F9314AF79FBA4AACE14
SHA-256:	DF9C03B6B2B0C5B56A1D49DF09E76090A6F419A968A556C8C75B2FFE584AD551
SHA-512:	C3D98B206138FC6DA741B5C8B818509D3187AA75B5AED4A3068D525CE175B60C97CB6C66B9B76B5C728374D473255C3EA3965B51B42698452D056AD35099B6B4
Malicious:	false
Preview:	..&.LK.N..6(..%.h5.n....#.-...z+....`.Y".....rx-....{......c.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{bd23ad5d-2b89-8982-a2f1-d476d89a5bd9}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xsk8i.Y^.L..a....pi.;...rJyI..v$).....)M.....o1;...a._....f..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office1F32A9AF-1274-48BD-BA1E-1AB75.?.(.q.3>..d.....9a.q...4.,D.}n...E.~Z.$..... x$....q.T..r.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/XlJ.(.`k<...zg..".#k.....,.:G.3}.....5^Is......z.f..PQ.b...]./TM/v2" value="Office21SkypeforBusiness2021VL_KMS_Client_AE"></editionId></tm:application><r:allConditions><sl:productPolicies xsk8i.GJ.L..0+.d.=s.3...3./..(dT.\|..[*R../...)v...Ee.F....h.200</sl:priority><sl:policyInt name="office-E1AFBCD9-12F0-4FC0-9177-BFD3148AEC74">1</sl:policyInt><sl:policyInt name="office-E1AXE.^...!(..p...f.{3.s...qNq;..p=Y....1E

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2021VL_KMS_Client_AE-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	12015
Entropy (8bit):	7.058019523653561
Encrypted:	false
SSDEEP:	192:amqTFTbTDhmwi5HyOYB8JMCA+cXtjkG+2TRfjaj75kUgilNWHI:amqRLDj+yRQdFce6a35L2I
MD5:	44C3341C6073FEA9B22D8F6FD9665776
SHA1:	3ECAC44FECAFC7634D697B34C2E9FAAE5D1C1765
SHA-256:	493CB15B3A49C82540064BD75DCB3CA6AF018829A3FF232A9151682BBF8E1082
SHA-512:	3908B7D43A84CF8A991AA67E04D628E87CD18ACCD1D61DC64766276071C44B7E1007D75E5FAA7E5CC145F3040C36424DD2EB7B66F1352121732AC7D9145F0352
Malicious:	false
Preview:	..$n..C.ZssW'..G.tYMf.....G.....^S........N.X/0>.y.puU...[..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{23e5147f-e694-47ea-b891-O.c,dD..[..6}.h....)S.>..........GE.N......G..}x..P.QB....O...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/oq.7...Q.kL/Hz.Y.`..2....H.......e.......T"&5.4.wxL........itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21SkypeforBusiness2021VL_Kfp.[=....~D"ct.._.41......]..............J.Cv3?.].n:V...Z...appid"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="ht_Sj7~..M../oL/.U.jF_......].....g.h.........p.?.i.wi....@>..WOjn1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8cy"( ...1.zyUL....n]Vm....a.....s.d..

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2021VL_KMS_Client_AE-ul.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10004
Entropy (8bit):	7.069848912975379
Encrypted:	false
SSDEEP:	192:tWgMRDHkRBVQywp0AH04TCcD6cvQRttt0S/0HM4XP4:tBMcUBp05yQRfuM4g
MD5:	1D9C59EE1AFF74D18C84F6F256E57C36
SHA1:	B1B05F8F7A8A1ED8DBB89D5D037B2C59D4F6CF43
SHA-256:	FEB5C74945A80E45E31022E27631520C54188E4DC1FA0A101C46DD78FBC8862D
SHA-512:	D35FDF52AD2B8170DE6708EBE7F430C03BF75D3AC490641BAE99805D708D4FF74768436A8168C9F4B45496696302CAF2963D3D7A15C1AF749B97CB8BE8B87383
Malicious:	false
Preview:	.....Y:]j^..`.];..nS.ETK.z.........y...Z.f..,.P.....IUT)l....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{3310cff6-0bde-4df0-bcfb-.Jq...P+O6.../..uU.d....BV.)........i...OoV.~.l-..9..k's!..._s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/v/X..y(.[a..=C^%I.*...N.k.u....R]..{..].9L.&.[..J.lP.=h..A.r:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21SkypeforBusiness2021V~"^..YsNaX..JC=%..d...F[a.c.........t...G....q.LR....PIT'`...\e="appid"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns=..a.....m\x...!..~..nA......~.....@_.....M....:..T...PP.om-.KFXhcWOjn1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW.6-...DHX^~..w4.Na..8....f.!.....!0....

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2021VL_MAK_AE-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11007
Entropy (8bit):	7.096762958000804
Encrypted:	false
SSDEEP:	192:Hf27N0ARJI2CEv1HpkppudtRJ0O7dqHxyNmYGB:eRffv1JkppKRjRGB
MD5:	99AA2A9AB0C5490CBA2479597804136E
SHA1:	DDF5ACC1DC4AC3059212FBF479707D039D01C3FF
SHA-256:	415E66093E90580664C2C8C2AF59D23A535D466596B051E9A1E5C790D60243ED
SHA-512:	91353867169440F6BCDE0AF3536380904DC9A03DF54CBCD154C951F20744F26B105A68B431DF590F0EAFD9394423B5F34DE251D89C3C7E1431636758094E2A38
Malicious:	false
Preview:	.......>R~..t.....92...2...,..-9.B...! q..:,Q..6.dm.2.(..2.u.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{27b16ae2-1320-45d9-806f-.......aAn.z....C.d8...~..../.Ehv.T....%.3.vlu..3.-.L,j+[.M&.j.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..u.....@'..(....-v..9...+.E/~....X.vok.+1e~.. .PzTo5}..7././r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ..J....oPj..c.....8p.......~..d).l..^.m"?..?+T._y*Ff"&.}.M&.j.s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b......:B=..W....a.[5........rA>.J....^H:. a..."2.i{.w]z.7'.w.PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4..z....6$=..e...Y.81......S<..p....

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2021VL_MAK_AE-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25933
Entropy (8bit):	6.714293287476269
Encrypted:	false
SSDEEP:	384:vXt8MhzhcOOzpzNCNW3wCPcGlgjv6NlLUyxIpoYdywkjQ/j:184SzZNS98hLLVsvJ
MD5:	A01D5D8CE795E9DDEB1710F61BB2F569
SHA1:	0F7063BF10A5A91AF364B047FE8333A797D4F272
SHA-256:	D206BF3274A3021474DD6A8B9528B2919A87B9559A8F17FECA12EA0765926F4E
SHA-512:	AD209278B381C0B58DC3017DDA52D4C33D0CEF52BFE712546A33D6162853738C680E18B0F74F05C5A62C7A995B9CA27F3979CC64A47FA913198917C1AE342288
Malicious:	false
Preview:	...G....<..#......q.]...8A..A...^..6l...5E..0......F..&..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{7ee70874-6ac6-4cfe-5d65-f36164e288b6}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xJrZ.B...?..j.......*4.....b..N..^...F.L..1J...&T\X.......$...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office6029109C-CEB8-4EE5-B324-F8EB2.&..A.............`!.L...o..........dj....B...9.........@b..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/XUSx.W...x..l......7.@...l.......\...&=...3U...{[...:....T.../TM/v2" value="Office21SkypeforBusiness2021VL_MAK_AE"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl.<\.....=..~.......)'.[...b......\...~bL.U/J...<W.........\|..:priority><sl:policyInt name="office-E1AFBCD9-12F0-4FC0-9177-BFD3148AEC74">1</sl:policyInt><sl:policyInt name="office-E1AFBCD9-1.X..L...s..g.......w..{...`.........

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2021VL_MAK_AE-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11982
Entropy (8bit):	7.1221606535383515
Encrypted:	false
SSDEEP:	192:BajI91NbkMD0O+a/S/qtpFqPiTbTBWfrYNkX88ei4ol8Xav:GIv9kg7t/S0FqafTB6rYx8rsX8
MD5:	D8502B136FF599CAA16FBEAEF148F893
SHA1:	CE8AA567D5F6FB40A42DA82B1FC346A4C278E113
SHA-256:	7640D62376F6F251E67504A6717E1BE019784DB87938B82AA36E63B64D00E33A
SHA-512:	65C552DFFA96879FF6CEEA597FC89E1E89BB4070F738732C586176DAC00450E2ABDC4C5BE7F741CC3C1FAE3E8B138393D89C8889E0BD3BBC3D3926DFB028D77A
Malicious:	false
Preview:	.....;...R.......7-.X.ub.......j..]....N.z ..9...O.I5....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{943bafaa-e1d8-47ac-a8d1-[*>..!............j'..E9t......Fs...M..=..,y......xHwF......s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..J..1..c........#i...~?.....N/..._..-e.u,..2...B.Pv.....itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21SkypeforBusiness2021VL_M+.X..a..........kx...to....R..._..C...b[.z%..6....EX.t......<r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://ww.ap..,.........uy...8#...)...H.......bM.z<..;....x.ZB.....1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRs;.k......x.......Hz.5.YL....%..DF.....

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2021VL_MAK_AE-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20326
Entropy (8bit):	7.17848798733089
Encrypted:	false
SSDEEP:	384:LkxAfHeVQXaXyoLl7VG+LaZ37p07GzyLqnpLTHUJvBIiqe:L1D+yUlhLfayLqxOD
MD5:	756CE64FA4E67D81F8874698A4AA5604
SHA1:	141E721EB306694A804BFDCA3604D47D9424B243
SHA-256:	E23AD69F9436E0E0DD26BD498661175601E119DAC9C0241324C4C421F0BA1996
SHA-512:	8B9BBDB40FFFAE3192DD66444D3291057BC19276CAA4F9FFB664328B50602DA367A75962883777893B4D006F210FCE8D704D63E78EA9184DBA59F436CB6C1E4B
Malicious:	false
Preview:	...@.../....i$;..t.'...C..o.D.h....../..!rT.lhKy..o.x.].Y..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{cc401030-56f5-4b31-889c-m......i..X&2k..).v...U..<.S.-....+.=v{..> wO.."X.F....Z..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..9.'...=....4h8.`.l....,.`.@.j.....y.c#ht.lhKy..YP.j.L...L.:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21SkypeforBusiness2021VL..5. ...R.....h.k..".w...I..8...p.....-.7 'J.ca.\|.?a.m...G.."><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://*.......}....J6e6..".i...G@.8.q.......t.1.'\.cxV4..6.P.F.]..rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0q..%.....}...32~?.(.T...C!.U.e.......

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	6672
Entropy (8bit):	7.180364901915046
Encrypted:	false
SSDEEP:	96:hqm3GHhsqk5rgC29GHouc0Dp/mMl0UaR3yX5G46DAP/etOZgRqDnz3bW8:hX2sD5rgJ9GHoyNOXGneEukLX
MD5:	A090267A0D4EE243DF8474C5F226A060
SHA1:	7D58CDEE487B5BA816E1B91F04A3C18C43631EAC
SHA-256:	7E3025CB81F7B29B0EEBF5D67DBAF507E11DFA9FDD027EA0B0C46C30EC239F22
SHA-512:	8F2D867AA2731BF1040C13EE90247F53D3A5A382AC7C8F01AEE65824499ACC768D0FD1E7FB19D12B1B73917BFB2E866A4C55F3D48ADC9916457DE054A5768836
Malicious:	false
Preview:	N6.....(b...:l.+....v.J..l..%.....S....B.}>.?..5.{..W."..D.e:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c4be62a3-2a9d-9652-43ee-358518464894}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.. .....a...>s.q....3.....8..r.....&......i:.4..#.>..M.h..I.\|.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeF88CFDEC-94CE-4463-A969-037BE......^.XD<G.:`.x..&.[..m..0....U.N..Q.a..d.<.d..].c.\...n15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X......$.~&ZY.6g.b....0.W...{.........J..Y.c8.5..~.l..}.U.b..9/TM/v2" value="Office19SkypeforBusinessEntry2019R_PrepidBypass"></editionId></tm:application><r:allConditions><sl:productPolicie.6.B...{xEE.'w.,....#.B..g..$....../.p..B.]e....&.!.J.".H..bty>200</sl:priority><sl:policyInt name="office-E1AFBCD9-12F0-4FC0-9177-BFD3148AEC74">1</sl:policyInt><sl:policyInt name="office-...l.-.%%J!.~7.U....c.....;..z......U..

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11868
Entropy (8bit):	7.086743833866426
Encrypted:	false
SSDEEP:	192:ZNDmc97oa/Z2vInhoJBslcIpRS5kEy61ZjODySKW872FoHQiRuLJN:ZNDmmU2ZphWBWcqJE51ROGSnDyQEutN
MD5:	3A9FFB7A63950A6366B83AABDFD87E62
SHA1:	EF37A14D368DDF7305FB4508A6142FF88A7F6C43
SHA-256:	05D5CB097805E5F2562CDA0DBAC206D7FB198895733519E8655C78823B0539A3
SHA-512:	0DE1F994E239EE738015A43028DE2E16BDB30B5E9A7A1719A4E6F05B402E65F12456480BACCF4EDB9BAAD571D92F22A80C18519293570B369DE0885B5403F433
Malicious:	false
Preview:	.....P..'...4BPq.r.$....=.....q....-..YR_0.7...M._5`..c..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e269a661-4243-4faf-b981-K.~....I93.....F!../.uG... ...T.>f....#....[.iU....'......w...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/j.....p<<~..+..r..f.oK........T.52....}...r.P<.!...Z.F,#.. ...itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19SkypeforBusinessEntry201.....M.j...^......gQ.......B.md...`...L)_5Zn..e.F)`..}...e="appid"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns=..;...._y&..n.Q>..n.6...}....B.c(...A...G>R5.7..e.F03..N...XhcWOjn1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW..w.....\"...Uk>....O.......~.gI....W

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	6589
Entropy (8bit):	7.10622228742241
Encrypted:	false
SSDEEP:	96:lKwsm3E84blRbJx29Sa+g1ogshtZdoNODVqduFPxc7K4fyLhAa/f5QRjNes:ld4bHbJU9TToh/Mk5hcwbRuAs
MD5:	9AF3C42BFA928227588CFBABEBA156AD
SHA1:	661C31D19B1BF941A64B7594C76734CCA6FEB9CF
SHA-256:	595164C2E986B6B552A73BCC1AD17612E602FA57211E36C329B2D99CFDCA867F
SHA-512:	3FDD2369112E15F27D0C32065BA7A33D09FFD56DD3975CD3A64384442F75B9F14768AEC0AD915F162D2CA098270D0856646D5DCA2EC3F204B7FB3519A2AD9722
Malicious:	false
Preview:	E..P.P)..pO...0W.-.y..y.x;...>(.... ..d..4{..JM...RaJ0."W..o6..M:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{491f5c47-3744-70b6-e650-ca106d776344}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.y...E<..sX.../\.5.'.Nk.,j..Pj....0.....[+..NB...D-...8P.E};..T.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office971CD368-F2E1-49C1-AEDD-33090.V.].jr..Vn[..<\.\|.k.[c..,..]l=...(..z..2hX.jJ.H.[{U(.(..O4r..F15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.X.^.\|...4.E..;P.f.9.My.{4..^r'..Oi.1.e`K.L]...."]0..v.P.f.../TM/v2" value="Office16SkypeforBusinessEntryR_PrepidBypass"></editionId></tm:application><r:allConditions><sl:productPolicies xm.{.V.Dy..r^..pN.x.:.J+.e7..M3 ..'..4..:&{..X.V..2^g.>M..;`..00</sl:priority><sl:policyInt name="office-E1AFBCD9-12F0-4FC0-9177-BFD3148AEC74">1</sl:policyInt><sl:policyInt name="office-E1AF.V.U..v..+.=..r..8.z.o..'l..&.x...Dz.*.

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11848
Entropy (8bit):	7.099950588269347
Encrypted:	false
SSDEEP:	192:/a5R0FnE2HcjXuvai8y5ChVa+0SdkQRcViPKRAkQ+Ps+mhS+b3rdHbUS:/aTeVc3iSv9GJYiRbPqo+b3poS
MD5:	934DB61AC0FE384632FDAC2805583E79
SHA1:	43CF049689E07FB7CD773F70F115F0D2645152FC
SHA-256:	9672F4761708FD81D9A0F07D3A45A67FB9897071785EED02DB6A13B1D10D0721
SHA-512:	3206CFB6550CEA526DC01BE45CEC5D28FFD3B8E80AC85ED9C655D308D5D1B359C1BE447B9444B7C9043F7FEBFEF0E21AD3637F7C81E43A9E3F28F5080DBB7D6E
Malicious:	false
Preview:	}`+!..3.!...e..F.j.p...D....By.vX.u.y.H.&...,...._....._..^Wrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d313ef41-4831-47bd-a087-../.Eh.2...k.....5.z..A.....An..9A.=.i.L..q..d..*.~.......A.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..2... 3...9..E.).44..OL0..E}..2.N..{........:..N.X.....B...itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16SkypeforBusinessEntryR_P..t.4'.`..K...A.5.-1..Z....Eq..?..b.4.7.......&........._....ppid"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="htt..2..)Bv...d..K.k.pd..G....K=..?~=..>. ..4....&....^....E5.N:Ojn1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8H..l...>m...d...4.o.yv...#...O\..0j+....

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25789
Entropy (8bit):	6.703225319941934
Encrypted:	false
SSDEEP:	384:QLL4jM95s4HPAeiKWCWydceeP9WggGUIVdRuiUXRGGEtldLVOKv5Z:R6bVif0dmxDwCvBZ
MD5:	EB3EBED8C323944BB20EF3B9C5DDEFF2
SHA1:	0D675DB647052ACCAAA9778B0FDE73F1A2AD8B26
SHA-256:	B76995386ED24C1744C290FF2C9EAFCF0034C8AD1F541FE9E2B374706A0B122F
SHA-512:	4FFB7B3A9182F8E0034B087851F6358C85C662ADB4B8E89B6E6216F597E8E7895FC1E957DCD6CBCCB8F032E85C1BDA2AECB4B39A8C5A23A9B0241A246694AC9B
Malicious:	false
Preview:	..S....U.=....q.....yK2....N.Qy.....n....l...E.......Y.[...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f180e44c-484a-9a1c-2377-8b98cf4cfb94}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.K......>.._.n.D....Vk.f.CZ...]v../..._v...N...@...4....V....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office17C5A0EB-24EE-4EB3-91B6-6D9F93e...K.....).}.M...CcZ5......V<.....p....&.2.........$........15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.j....0..y.Y.z.W...UyV1......./..L.;...5...O..O.Z......../TM/v2" value="Office16SkypeforBusinessR_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="httpJ.....ST.(....x....u.cs..'...?...Q..p....$...I.....Io.......ity><sl:policyInt name="office-E1AFBCD9-12F0-4FC0-9177-BFD3148AEC74">1</sl:policyInt><sl:policyInt name="office-E1AFBCD9-12F0-4F3.....J.....T.&.f...h.s..P.O..8.....p.

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11963
Entropy (8bit):	7.0103350025605895
Encrypted:	false
SSDEEP:	192:vT576NPYpJ3ohpccyS+vE/xJABVJ59WhjrFcY:vT576G/3ojccySWE/xqBzMnFN
MD5:	DDE5AE933F574C89364AD081346A1628
SHA1:	54C0B47FEAA5736143D12AB7A28F753BEFF65188
SHA-256:	C7E85EF71137A8A0F174B59A5D7201D98DE7246EEBD729C9C2583DDC027DB3AF
SHA-512:	E70A24EFE8AEF0BDF35F99621B8233861C21E56778BF5DE36783613C96DA83B3F97BBAF98AF899F22284C215CDCA57B1591A91B3E506A53689E3ECDBBB1D68DA
Malicious:	false
Preview:	......vJ@.#=tn...B...\|%1&.58FC..i..-...#.F.=C.:...d.g..+..krg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{9d992c7a-bedd-4fe6-892a-. i.F..y...f3?!..A....03,,.6/....K.=...a.#..o....x.S.Y..\?..?s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.D..\|.4VX...ak3.........wx.$.2<.A../{./...q.yI.0U.i...i.~..@h..%itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16SkypeforBusinessR_Grace".r....B.Z.)>od..D......( 10.73E]..iA.N..'.bd.3C.k.%.b.5...}..>pertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.o.qr...I5Z..)#qe..JP...S.;;.:3....BA.z...o.QC.)~.*...e.e......+4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExU.A..k.M.S..#\|Lf..N1...._..z...+...u..6.

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10987
Entropy (8bit):	7.144955518726762
Encrypted:	false
SSDEEP:	96:VmeSbHiLZdXgr/jl5aZTA3qFIAU5Lh32THlSjF31vx7gRmqZ73mU/jDq+oqC6MLP:WHourx+McWNlCHNmsW6ATEkIvDGWrCh
MD5:	7C7444979C97FB56512EA252CF938C2E
SHA1:	FD83BF192727EB899435A4A86F0DC8D469E441D6
SHA-256:	E868B2F0205953E271DBA054677B5046944E0F4C80CBA74ED4EA9A0E7BB5D09E
SHA-512:	1001D00694437978F82E8667DBA4B3A30387B290FBD22DFB71E93A5D0ADD5EDEE6BECF3F25C0F79E385DFD5512855C32E3195499DF3203280359B3EAA653289F
Malicious:	false
Preview:	.._.'E.`+...DAM`.!.k.3...@..Y.S.....~.....]..:...4.......)>..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{a5cf8805-441d-4460-a379-.....>J.!o....[0.~..:PkY..J..N......n.....TKSh.........o..==.Us:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/:....-e.rr..[..c.b.. \:...B..].Q...>..H....C....?....I.,3M./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .,...2M.b?...D@D..,..sN9...H.WL.....8....]..?.......I..==.Us="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b.......ph...Y^mr.W..+I"/..a.%P.?....w..o..F(n...6.....N.<..jPKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/44,....N..h....tA..G...&......B.....o.

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25792
Entropy (8bit):	6.653575158644103
Encrypted:	false
SSDEEP:	384:2uG6OG4ZdzqSOhYYM+Cn2E1RweeZOzIBnekBnBzWSID9usc0CTZiw:GKPYY9a1Rh8dj7Aq1
MD5:	E01C2F5E7C7F1923B04509A590DE869C
SHA1:	1B4006F4E07F550362112E99CBED1B287AF19A8F
SHA-256:	7D7534121504A06158B83A45C57E95FD255E6826061AAB83B77ACE0C73914AF3
SHA-512:	42DF1EEEB7791C084784E95F783E86BDAACD7BFA6CAE66626448FB1945168D33B64371E57765EE59A4AF816C82C380A64DD21183AE4DC5BE77BEA9D1505D60F0
Malicious:	false
Preview:	./..[zf..Z.h&........h...k<0._...b..Q+;.Y"../...>.)..h......J:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{2b2965c7-a73d-a1d4-871b-ef228335da70}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..:.^osQ.Y.to.....C-...:cd..B..E..Q^A.)M.;...#T?..'.........S.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office418D2B9F-B491-4D7F-84F1-49E27..b.Q;<L.\|.:.........8...\|?1....Ye...-%..$..3..l. ..p........A15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X....KVFC...$i......o....d='...GJg..Sdn.Is..1...6.b..h....././TM/v2" value="Office16SkypeforBusinessR_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="htt..{..u\|B.E.h:.....Ke...'.&.}@.m[..N1'..r..1...9.5.5......Krity><sl:policyInt name="office-E1AFBCD9-12F0-4FC0-9177-BFD3148AEC74">1</sl:policyInt><sl:policyInt name="office-E1AFBCD9-12F0-4..d.]3<[...^f..H.....h...' 8.A._Wt...g'.

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11948
Entropy (8bit):	7.07868805273513
Encrypted:	false
SSDEEP:	192:QxysQUAVMJDyFnQsf83cHLOmuYlRmWxzGj4dyjPSAIKST:QMsQHVMtyFQslAYlMW9GUo2KST
MD5:	DCB12CF33A8129A3022FEFB30EF82E8F
SHA1:	1DA9E9539BCDA1E8549EA247B0CF9FF9DC26CE97
SHA-256:	58AF0364B6C12B95F0913DFDC002BA601A6F0E862E6C5B0CCDC5871F02A99AEC
SHA-512:	B78DF323DF9893E1A1E755FF9A9FC664805200CEF435CD162799CC87695E36E79D866B383FEE4CA663E2F037D302696BB220FFE0B103D051D75FDFBF3006953C
Malicious:	false
Preview:	...J~........Qz..s..<H@[..v.-.........0.Nbnh.?..+....B.....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e9cea07e-4641-4e8d-9ecb-.7L.L1.S......0G*H...Vd..Mb.%.:..\.....>..k81.w............Zs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.U9.-t.'.....".y..g.LhAK._.y.).W....Nn.e1ad.)..f........@itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16SkypeforBusinessR_Retail.ZH..<..m.....bZ4W.2.. .\.v.m.&.Z....M`._9pO.7..l........FopertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3..u..G6.[.....\|[4M.~.. .}y[.f.+.......My..4Ch.-..-....t....z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlEx.u#.&I._......AX.i...v/kkuR.'..........

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20292
Entropy (8bit):	7.251895033969945
Encrypted:	false
SSDEEP:	384:Xalyf7P3uTjYHKys1m9IqCmNPJ46y4y8ye2awttXMs:XTzG4qys1m9IY+6Zy8yeA
MD5:	CDDFC08D2AFB4128AE6E91DDB9C0C7EF
SHA1:	07278A16FB3B540C67AE3FC2CD23989C68F44C07
SHA-256:	9975909703610A4B640434C06B85CF3ACD445CADBED1FE6477E1E2F3579E2A11
SHA-512:	424B025EF49109DF1254C8DB931E84FD9377F737E334478865BF62EC14D8FD958F44CA76AC8FB6E227B219BFD043175785BC5ACF24E2923C97DBA817E2A808CC
Malicious:	false
Preview:	L[.2V.....&.,...C.Q#ES..I..4...u....yu......%......Z5.HcZrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{84a134db-8432-4edc-93a3-...6^..M..Fg..c.....[r....C..#...l.....w7.........2.....x.K\|.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..!1.9.....q......h.Z...K.0..7......i......%..I....K;G.?.:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16SkypeforBusinessR_Reta..SU..O..&9.;.....n......!..?......k......;..C....FzP.bZpropertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w..]\|...E..Qd..;....."G...l...t.....0k......!........ .q)y6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRl.g\|>..:..Jm..1...=..C(e...`.k..Q.....

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11499
Entropy (8bit):	7.1281127618745685
Encrypted:	false
SSDEEP:	192:WaMFX1WSI3pzgopAcBXn+ENAQPxfrbMm141PtQh:rS1VI3FpAMX+EN5fnMm1yPtQh
MD5:	4C5A4E6690819AE1939159F2334D34DC
SHA1:	60BDE24E53E796102E7DDF5FDDCA29079F1CD57A
SHA-256:	8AA689CD989185E962BFDC5C4CCD32E323277CFE7D657649543580FA6E33AA24
SHA-512:	A2ED58DBE9BE60CBD2F570EBADEBF42B0EACC400C791C645D197F667C662C4F64F9B2331C47289CF89D4E3F6BA3C7EFE6B65A3FE7B9744F7E143E2C6F60B9D8B
Malicious:	false
Preview:	.y3...{.P...fl.X..s..y......^Ja.....j..7M....o.......;.k.....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{444d322e-74cb-4a6d-a1e4-....../.D...h'.N..,Q.(.....IvI....5..3C...6.A<.,...U.....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/h.....[.B.&&:s....0..2....QMeI.....'..`.....&.......t.K....N./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll Z....s.R...ql.Q..~..a.......t.....>..h.....;.......'........gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200...{.....6'.....i.".......iiH....'..o+.._.C;....3._.....%.rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV_...S...6.S..Q...h.b.....FO_m.......

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25841
Entropy (8bit):	6.594115325650749
Encrypted:	false
SSDEEP:	384:fEJYAvaI/T3KVSv6g5CnkXdsml+/ei5TLlYZoc0GraHUF6T2niFFWTCNCXjtgy4W:MBb3oSfAkXd2vGWx4xJV44ZL
MD5:	56382BCBCA1C1360209C98EA97795A33
SHA1:	B7C7FD4D26CAC2B1853EEFBA06027A71F9CB4E5B
SHA-256:	2B3DE7009C05CE5C8AF3500DE4CFAA995A4717438A8D3153AD632C871C2F96B8
SHA-512:	6346FC68B3D56E43EB63E03D08D2E323D2588DAA34CC4AA13A76C0358D514AFF8137D038647833A593B1969C104D123D41B83D11B6463BAF332C82F3757DC613
Malicious:	false
Preview:	%./HK..eb.=<..../...n.>jIC-i.d. Oy7....JvY..;...._.....3."..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{3df0ba17-7f47-c793-1d89-6adda40ac42b}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.c..N..4`.* ....7...\|.j;..w=..k..eyB}....lM..&.XH......!. ...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeBDB32189-C636-46CD-A011-FFB83.M.AF..)...n....~....t.9}JBz;..!.5G 1....Y<E...i....G.....h.f..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.B.F[..&4.zp....d....n.=eHTy%..2.n.{xR..Q/G..3..W._U....V...B/TM/v2" value="Office16SkypeforBusinessR_Trial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http. ....d+.*!....n.......QTj.5....".v1....H>\..!...E.F...~.>..ity><sl:policyInt name="office-E1AFBCD9-12F0-4FC0-9177-BFD3148AEC74">1</sl:policyInt><sl:policyInt name="office-E1AFBCD9-12F0-4F.?.ME..$s..}.E...N......zJ.4h..%..G 1..

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11960
Entropy (8bit):	7.065325350419679
Encrypted:	false
SSDEEP:	192:943Say/hpVc9h4nZBQQKM4btQxluOW2nMj5Ed:9iSaopVc/4nZGQwuxoh2nMjKd
MD5:	459A7954D2C49BFDD6785F7FA534EF39
SHA1:	83C05CD98CF8D3840A02EB95B3518EF206607B53
SHA-256:	47FC977B0CC06F9F07F2273F22D3E11AFB58586512F3AB08EFB4EB5FC4BFD345
SHA-512:	DA60FFA40FE39A11D06C37E86D2933D74D88AB08059EADE78ECDABEEBAA34EF4FACC4679A66E0A408BF9013FB118BFC9E421A7ED6718D5F83621B5964294A414
Malicious:	false
Preview:	.k.[...WJ..k...?..ZE...0...#........./hdgR......F=..p.$k..I.g?rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d48f3998-3e3b-42f6-b530-Z..V...^Y...U.)......'h...)B....e...q?f`i...F..z...#G.....].xks:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/(.tHb..wX@.T...s...Q..+9..!.....nT..Z-859.......Mn...}.=(.....qitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16SkypeforBusinessR_Trial"1......c...a..."......p'...59....-X..dL;6{V..2....l..v.vu....fjpertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.o...U...ZV.a..."..HI.......>.....a^..rx;/(......@-..q.&...l.".4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExU..c4u...SD.k.&....)&........ :;...Q..@4.

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.142044751690667
Encrypted:	false
SSDEEP:	96:F1m3j1gl/fn8QxT8K7QB2clSWTlLE8Ou9s6IatwZgRALOc3tyFvK:4+/fn8Oc+buhVSr8K
MD5:	BD766C64F01F5D7E3B6684CDEA1A1A81
SHA1:	057468786A5C6243AA51BE72139B0C50F1A5E418
SHA-256:	D9066840A1D64DAE605A755F10FA4718DD630BD391F9A7C946EEED81CD9675BF
SHA-512:	4CB1CACFE34A31DD10CFEA664F6FAE7EF6C7636CA9D9D9E887A4FA98A0F1A25AC0BD7692EAACDAA74EB0F623EA032E3D9E160D70879859E514A733058EEA562B
Malicious:	false
Preview:	.qY.....~.Ob.v..BL...._......}f8..&e'...<.!.<......5......:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{75d35068-b312-06f7-a767-bca72488230a}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xv[.......i..Pi.nR.....L.........WfM..V.w...3.<.Q.......m.....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office83E04EE1-FA8D-436D-8994-D31A8-..$~...d._...Ci.'Z.].....^......u?>..tc4...;Fs.5.....t.$._..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/Xiz.W....B.9..De.=P.;.....H.....4dw..64<..,.).w^....B...#../TM/v2" value="Office16SkypeforBusinessVL_KMS_Client"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl&...H.....l..Io.;L..............)dS..nkw...3B?.0R....=.r.A..:priority><sl:policyInt name="office-E1AFBCD9-12F0-4FC0-9177-BFD3148AEC74">1</sl:policyInt><sl:policyInt name="office-E1AFBCD9-1)q.H.........J.g..J/..A.........t'i.

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11983
Entropy (8bit):	7.102082589457819
Encrypted:	false
SSDEEP:	192:ZpgSfJK94M5B2JYlO4bXJzYjm/l4SUUnRSBl+EwrgkW:ZpjfJKC2B80vXJmmt49Unzvo
MD5:	059F5CFACAF697C5BC15B6BCD97DD49C
SHA1:	24A4B857D2ADFD3AD7985D28D124ED2A650D3BFB
SHA-256:	7AF3CBCF8548BEF454FBD5277B87B149C9DB917C38179F5B3894875B538539DD
SHA-512:	CEB377DB255315C0AB4DF21A307880A64D91788685F27C2ADE4DB60F97CCB1355BFB1DBC086133D049244948A2EE82E0A1420F6D2C7685D9F5EA5A7705A6A101
Malicious:	false
Preview:	-..'....p..........ND....F.\|....u...BR:.%<H....r.Z`k......g.~rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{57ba3c7a-25c8-4a92-9f82-..#+....a.Z..S...TSD.J..[./....:..B4.+~...ZS:.lI.......s.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.nV4....b.<.S...H...F...f.s....1..6Pj.{nc...d..-\|.......$..0itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16SkypeforBusinessVL_KMS_C.U~u.....R..)...JR..A.....:.I..r..DLw..!]...Ba.[KM.....b..z<r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://ww..l(......X.L^...WL..[.....G.2..y....;.T!K...).hl.......e...1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRs.nw^......'.HE....q.)....z.S.>..8..._

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9972
Entropy (8bit):	7.14202006349108
Encrypted:	false
SSDEEP:	192:OP1rJ4JmVkyUorpfwZFUry4Ud+ZDTimpv9gbXv:OP1rmqZc4K+Zxuf
MD5:	C11921396B1F8052F32F771C3056226A
SHA1:	4EFF5257449A14FEEE3F5D715F7A7599DC0CDDB4
SHA-256:	82F28AD3FFC0EDBB7B48ED94ACE02066E071A3D2C17C13860183988FC650636C
SHA-512:	0442FE737F0BFD8E3CE7875818D8FD83FE35B47FB84A834D285181877FF83D136B33B8113A86049B0D51553362BE37B1CE525222C8420569C91E2631E09A5CCE
Malicious:	false
Preview:	wZ.&d..Qc.j....&K<7.[.F...,.7..W..({.....{t....a..........rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{35315a86-0f06-4812-97bf-..*l..v.7..LO0.rh.QV.....&.4...N..wk...I.r".........p......s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..5...qq.[...]jH"t..L....;..0.....P.\y...$8.....C..A.....r:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16SkypeforBusinessVL_KM..v2..Ia.3..T.&.sj..U.....'.g....E..Q5.....'w....G....F......d"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http:/...mu...,.h..^_xY.?..H.....k.g...h..F8.G..w.....J...{......1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0..K...E..X.!&\|B'-...7..........a#.H..

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10979
Entropy (8bit):	7.156421655169678
Encrypted:	false
SSDEEP:	192:Tm4hGY+MF3b6rAKHqjqoq7RR/Z04QK/PYehsE7:9hh/3VyPoqV0s7
MD5:	CECC3C8574904D2A6BEFE42836618B89
SHA1:	A6E7CE065036B2D4550F7F8868105BB71C5BF3C9
SHA-256:	5C370CE7B598BA55C949045D8A13F0D047DB3E226C8EC74861C6C2BF296F4FFA
SHA-512:	944DCB59192E3093A69CC755179F1FCAA5BB21BEF9F3A3F2E02DBE68163A1776CC4233A0F1487851E64BECCF139F41274F5C44AA9FB3674FE44FC4A458CA6D10
Malicious:	false
Preview:	k....8..%."G....0..d..l.gd...t..D.F.r8..q..O\.....p_...8...Rrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{00986d3f-1127-4817-9488-.iA..%..5.$..S..`..9.4\+r....c..R...\|<.&..........G....u....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.^m.2..7..x...T3.p..8.l9...p........!o.....s.....?...9..T/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .mR..-..'..[..../..e..*.{F....a....j...(t.d..HY.....IK..u....s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b.G......5.wb...8"....-.]L.4.}..L.F..G..X..m.....}.......9PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4.mb....S.(r.A..Z..e.t.XQ.F.&....v...b

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	7531
Entropy (8bit):	7.0975505551482785
Encrypted:	false
SSDEEP:	96:4Pm3hfpMAmXnehj1V7NhVDuBaviYwHODXxBjAIvt6p8KVAaIZmYGy0hM9:bheAmXnexjNH+aK7uNBqPcmyR
MD5:	BA87144C37DC4BD6DA7346FB75669819
SHA1:	FD06FC61E948B11E9618C35006B42AA8EDABA09B
SHA-256:	093815A1FBC9453BFF5E356D8172149BF324CDED3C9474A9B86D6CF50702767E
SHA-512:	6C44180BEBD9AFAB1CEA36A66FCCEF49BD9ED4D628971697D2E6839E3E6727ABA78C1C2B41155DBD4DDFBD4EF9E0731E28054ADE9839DC85CD4F137DFF8744C6
Malicious:	false
Preview:	\.Vr.jS....v....z.{.p..@...Yr..k....`.s.b.E>....26.K0}...+:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{7e2d8988-098c-490e-b483-15d0a1ac9265}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x...=..F....j....\b\%.58.A......~.5A..d...#.v.J5...Z.}2.Lz5...2.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office03CA3B9A-0869-4749-8988-3CBC9.].{.P\|....$....U+Ti. 0..W...Lu...cX...2.`.~.Be.....3..q?... 15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.).\|.Fs....:....O1^;.6*..O...V;..J"..K.p.h.\|.U4.VU.2u5jG ..&w/TM/v2" value="Office16SkypeforBusinessVL_MAK"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:.K.9G<S...w...X7\z..G.#Q....m..B/..O.d.s.a.O/..J..cu.T0...,ty><sl:policyInt name="office-E1AFBCD9-12F0-4FC0-9177-BFD3148AEC74">1</sl:policyInt><sl:policyInt name="office-E1AFBCD9-12F0-4FC.I...%.....5....xo.w.c6..O....W,...y..O.

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11950
Entropy (8bit):	7.098913254712934
Encrypted:	false
SSDEEP:	192:sd7WEV6KdQ1TFk20RRV7z6gWewLacIgK3Ehe9TkrlkRJ:K7Wd7158RlegWeq3IguTkrk
MD5:	858AE84FDFF32DA924F2BB06DB344523
SHA1:	BCECAF6CF3F0F591B801127ECD8382B76B659B07
SHA-256:	6E6E94E1E73E5E0831020ACA0098211AD97BA3AEE25FE3B562865B38AF6898B7
SHA-512:	1E2726EFD7FE42B19A17E878C5634FDCE79FD09975160E1EE5DAFB7CD4BB278C052EBBEB892F593AB58984737CA45558B4CAE7B24CA9469F5A8016639F872269
Malicious:	false
Preview:	...,....&...N..%.P.=7.&....U....5#...Y.z..^.......i..Z..c.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c28c2b4d-2c7e-4faf-bd9d-q,+'...>..@..uF...lo.j....BF..#k...].8\...Z....^.......\|.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/TN.?y...4..4....&....vc.-....QF...s[.....( .Q........d........itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16SkypeforBusinessVL_MAK"],3:@...j...O..qE..0e..........<\|.K.G.i..S........b........ertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.orw3z ...?...Q....C.MD......GF...<j.K...d-...3......7..~..j.YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrGF._h...-..Kl..{h,..YR.......bD..\|X.^.

C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20294
Entropy (8bit):	7.195629570261479
Encrypted:	false
SSDEEP:	384:9AGsoq42gdesLlyk5BcZ0ny4+RmxiuhV3yRWNy0IX14QTT4L/j1:lqNWeMlykkIKRXubyRWNULsLZ
MD5:	65EB62F3481D1E361EED1CF24B7B7086
SHA1:	9AF44159CF974A0A173D5654FC136FFFC28BE843
SHA-256:	D3A3A0294AC294CE860E2A73B75C8452F230977DB4583ABAAED1319C8DF4A110
SHA-512:	30FC1C3C35175DF7F271990ADF44C7CA58417DCEB897D7CA54D1096CC16F9B485FD6A9C3B03D0F6A7366D9D1942614EEC91A7FE2D320877245CB4C7764146215
Malicious:	false
Preview:	_W.*....6g<U.W.v(.++..z..E.[......F......7..$>j.Ex.a......W.Trg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c8246a3f-5cdc-41f0-a9f5-... ....ts;A...`x.tv..".S.Q...\..P.....u...}l".sQ.@......T..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...9...$>.j.H.:+.h?_......Y.........J..+...$>j.Ex.;.........:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16SkypeforBusinessVL_MAK...9..N\|5b.N.}f.sjE.f....P.........E{..e....<b..?.c........opertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3...9....9!`..S.\|f.}&..f..g.Z..N...SO..6...$kx.^~.\......p.Xz4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlEx..L...."(re....Z.yGf.i..k.l..k.....a.

C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10987
Entropy (8bit):	7.119400673773348
Encrypted:	false
SSDEEP:	192:AMvUUfYra9+asKz+5gko4EfbukqU8hoBPkRT:Lp+asKkgk+zu4CqCT
MD5:	3741E414160F5DFC1D9D84B09E23A68D
SHA1:	76915386196CDEB5665B928FFABD766695D9ACFD
SHA-256:	DD508429C164CAA90DF690D1184769206E7839A393964A4C5D9344E0D51C8927
SHA-512:	00857AC683440D45A1666F65B34E92D15869AA2BE47AD5C5F9E44A51C89A102C9BCA1AD58BCCED1D43BC11D9CAC25EBFA630C62A7DDF8512BE51678CFA1BF75A
Malicious:	false
Preview:	....FO.m..6.d.-..DC.p_.m..F.........H..^.3...f."S.X..W.q.Mo.?a,rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{95e45783-f86d-42c6-852f-..IV..GI)..&./.;.....!..!..L...........Z.q...?.jo.qn.`.Om.".<~xs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/o$g..Lo6....{.a...W.;..f..D...........)../..^.S0...QKWn.2;/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ].X\|.SGGo...d.$..IB.h..q..N.............}...a.(..v&.n.mKP".<~xs="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bM=.c.m..}....y....2!.0..W..g........H.!.x...D.?~.Z..Z.9LzX..cGPKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4a.h..tD.....=.!.."B..G.R...........

C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	27582
Entropy (8bit):	6.64602886326785
Encrypted:	false
SSDEEP:	384:gL81s4r76qgXPZ2WUEwQtvV1EaR6czcnG3tf2oye85MBucwzaRqzPVi1p6jVTWCW:R1JHKB2u4naPE2qz9RjuRrDPyfY
MD5:	73A9A9886E9804D735529E4ECD5A950B
SHA1:	C43E42D2FC34C964AE5038C1A27E69CB48B3D28E
SHA-256:	351EDD76E3491F8E1DB59C04548D6D38115B86B8FA325A8251E132FB570BCCF3
SHA-512:	162171B585F78804FFF3FAFFB20C70B6D37EDFDA2B3F5A2052FB77F180F86E90B800F9366DA3F5D5D5B165882E1132CABC8CD525301DB5E076B3C83C2B03F1DB
Malicious:	false
Preview:	...Iq.........%.w.JP..z.$..&J.....W.<}3... p....tBq-...[U..).!:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{463235c6-7ce7-a0d9-b9f8-02d7d7496940}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.k..t........:.-....[h.p..r......WqFoC..4t...Wb.4b.......+.8.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office1C9D26C1-4001-41BB-8B90-B8367.D.6v."..'.]..).$..B.N`.#..'........"1a...<P..I.}Xn5.......m.*15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.J.Ga.+..E.C...>....Xz.'..1..E....UKi5#..>v....?.f-W..,.....}/TM/v2" value="Office19Standard2019MSDNR_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="htt.=.Z9.........%.>..........0n.......H. ~~...>p....h\;pH...K.... rity><sl:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-4.5.Xv.V..F.;..\|...B?..d.v......]....H ~

C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11944
Entropy (8bit):	7.0371553362238695
Encrypted:	false
SSDEEP:	192:9RwCuR0aNI1JD23f7hdiMBGqMTROe0oZLH86U:HzOfNcDM7hwMB7MVJ0p
MD5:	3D9AF3CE3D5F5183EFB7B067B2EFC64D
SHA1:	07BF63CE56723EA3BE32F927FBD160AE63B98C4D
SHA-256:	1B46B773EAB152F0BD5DD81792D2BB09B9AD2C38C9ACD0FBE6B978948B2DE55A
SHA-512:	82049EFAB65EE5237CCAA8D5AE13437ED207AEE7722E7482498A9EFAFED31DBFAF6E71EE988D8796896BD218684E896F9A7BF022BA07FC9DB17BAEE4D39AC04B
Malicious:	false
Preview:	..yFf<../@W..a}..,{.!"..8.....,(.I.S......1:&2(.H.Pr.~...5..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{a2902d42-5b73-401d-b69c-....lv%N9.QX.2..b$G+s..t....tm.P.......@8l.``!~.:S.&.....6.+s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..U.6.;=.f%.~ .28.ei..3.....t..S+.....<b5?>...Gu.g....).1itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Standard2019MSDNR_Retail...U+~".W[^-.x`..}#[.>..$.....}4.OI.......j$.0 ...vp.b.....a.7opertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3...UktsG ..G.e~..g-.3>........}...O3......Ng.&g:+S.@O.e.....sz4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlEx.. ...C;...:C..C)v\S.......SZ.g@..

C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	20288
Entropy (8bit):	7.163846824401419
Encrypted:	false
SSDEEP:	384:pBe2Rup9YcOfqyqW9+z3DseiebuSW+Vth/M5KZyP8m:1cOCyr9+z3hJVv/M5hx
MD5:	431D59A50F904BE826D4F67089BD56D9
SHA1:	121860DC7F3C1461EF8D72BFD3A4FE36A06ADE85
SHA-256:	0F0D1538C3146ADDF26886C1F49830C2A5E78BFED2055BB838B46B7BA6D12454
SHA-512:	1C427613336B1C3A6702753B88F6222844AF82A9145ABA4EE3C5587B1428D9EE3A8DCD9015F28766CB7BA498AA0CBB58026E25F61ABD7D188BC71A93A5D776E4
Malicious:	false
Preview:	..-A...Tg<.E.*..F\|0j..>.s....71.....m..@t.K....0...u.q]m_~.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{46af42ea-dbe5-451b-bf2c-F3.#J...&:.K.e.B.#m`..f.e3....ot......i...}.....>.c..K.+.y\a.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/2..>&...F>....w..X?$...7......o3.....;.Bn.K....0n...g3`S(.".:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Standard2019MSDNR_Reta.9.LB.......Z.=.].>m3..e.?3....K........!.Kn.C....0s...u6m.?...propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.wE{]c...D!v...=.C.>w=..e.B....\r......7.R=.N....&...o18BO.l.y6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRl3-gc)...=%m...7.~..S9....V....RP.....

C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	27510
Entropy (8bit):	6.602046664429788
Encrypted:	false
SSDEEP:	384:HrMsyxqLSGBW224L/xh4p4PKCN2TF/W5Z1ePw71d7hoRXmY6O4PrP2ZBV+wskSB:w+SKFq4iS8F+5ZBdeHczzws9
MD5:	DF1B59AF604FCF6BD1CED9F3963A53CE
SHA1:	B03A11754F9DF98EAC5BE5766CD54EB38D13A0D5
SHA-256:	08F17692625AEF5CC3111674022C53C5A9B88F5AFA3C920EA00B49C1BF7368D6
SHA-512:	96A61E1E386399A1E96E9DE0DB9B04E7AC4280BC891581309F6D5DF07D81BBBD2EA8ADBB3800913D495F2733B901439C1F694838B3101E0FA4EAE2CF8F15F8BA
Malicious:	false
Preview:	.z.:..3..X.../cq.n30s.W.h.I...Q. .Q~r....a.:..U.r}=....r...M..i:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{9009c12c-fd3a-0b5b-8265-82be12203a4c}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x8..u..&..[.+\|z.von&.ED<......./.`Tr.........^.;kq.B..uIG.@..p.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office42419D2A-5756-47C5-9AD3-E1548..G.....~.../oz.?g"l.M.o.J...D.e.Dv+....g..&*...rt'....?BM....b15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X'..4........#hv.%mp..W.k.H...^@v..7p....0..$.._.u6~... StR....5/TM/v2" value="Office19Standard2019R_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://w"..k..,..A...%cr..PSl..8J.....@. ..k3..2.."....1$2....sP.....9<sl:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-442E-8g.+........M/.r3"l..Ov.J....Zv..k3..

C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11943
Entropy (8bit):	7.1054473895889085
Encrypted:	false
SSDEEP:	192:F9BTa5wf8bEIfx5UqihNOIF5+TJHV6X4+XBvUBkpgRbE:45wUAIfbXMUQ+dWJWkpME
MD5:	B1C96DF65B381DA048B48CEEC50123E5
SHA1:	EE97F8682557DC5E5AAF004DC68C6C96B464BEB8
SHA-256:	938462697DE2A8073AADDD30BC4D4B6791952E2590BE04EF13D90FB1C27959CB
SHA-512:	4A0228E3CE62DCF75D2CB3159978DB0F1BCE98C7C3C98E7FF1D63DAA34EEC47189DB7F2EDA95B9F9B9B81E8E912D24F6B7AC75ED63862E3A36813F41E389B7E1
Malicious:	false
Preview:	.. ..JV33......x.T.........*+...L..../......O.i.Z..6....)._.crg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{7c13eb4a-f7d0-4ee3-8fc4-.N...S.m&S.N...nV........ x...D...p.....JFZ0..f..\.....d.\.7s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/q/..s@v.!O.1..4.J.^....($..NO.W.[.A..6..e.Q..!......x.C.-itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Standard2019R_Grace"]</r...F^~'c......x.J........p~.......7\O.....]".D..S....+.T.-yPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2.M.....'~.....4.J..k.....;'........d.B...-.c..^........>.h.:YlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSz4....y-!1.3...[hE..g......%.A(...m^y

C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10971
Entropy (8bit):	7.197816514879063
Encrypted:	false
SSDEEP:	192:Wh9vXmJ+3BOmjoLVsqrvcdsZr7yP8fjsN7nMTmO9wz6C:Y9d0m0xsqrvcKZr7wIjg7nIE
MD5:	C6CE411302BF3B2DEB18CCF8BD7EFA10
SHA1:	BBB41807DB8FD450B0AB3FDF0776AC6F95271452
SHA-256:	097C74B37AB10F2ED0450142FA6953400BB17770BA9195F3456945D3CE788CDE
SHA-512:	3397F530B75062D93030D6A6EA464F08823774B6A18182F7A47FF4C493661B2CACC94C0E28D9D8F9249576541980F945BA3BADB50DF3846C957BC1A86EC48102
Malicious:	false
Preview:	....H.....s&.....!DM.....x.h.....K..Y......(.x...M.$^..Y..#Zrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{eb807054-6563-40d3-b788-...@.....3(....\|N......r.k.........W..TZ..q.0);.'........<.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/~9./......Lz..Z..5......z.o....6........a.t...y.k...C...y\/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll L.........o1..... .U...p.:...........X.../.rEB.o..J..D..<.s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b\ ......V..6...CC....Y.H.....+..?.]$...e8..@.)..n..!1PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4p.........F7..... G5...+.G........I

C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	27513
Entropy (8bit):	6.707386589478297
Encrypted:	false
SSDEEP:	384:UafD7dIsXFFkuajwCw4VbuoZKYMR7CE+CXBs5qeeP3W+wNseeFny/yAIkazwecH:UafChdHMNjdBsoee5y/H
MD5:	99016EC801287638C37EC709B90F0526
SHA1:	D41A1A2445F755C4318E5F29914B2B1ED986D490
SHA-256:	3EDE6006421C5C2F8329E6FD31278DF45B615780DE193A6AA45D13DD385D168F
SHA-512:	318DBA30162D1EF8E8BC4DCB4C09A6CA2811E04D23FED4E2F439EC34179AEBA707369484A3614ED47FEED91D6C92878C0689EE6BE35C4F680F919853E66F5584
Malicious:	false
Preview:	s.. ...*x......D....D.....Hi..!rA_LH7m.E...P.A.t...D<..O....m..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{33ceb76c-2146-783d-f68e-7beca5dc8558}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.Jqo...{z.........p...P..3..-}fnfHB..5...D.N.iU...s..H....o...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeFDFA34DD-A472-4B85-BEE6-CF07B..^]..5f........<.......I>..&7FJD.1s.....L.F.&...[$......)..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.kS...;i........n......._=.h$D..Jx8.U..N.Q.\|.P.S<..n...U../TM/v2" value="Office19Standard2019R_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://.Qh2..47..........R.I..'...S..jb....cu....U.[.(_N.."..L....q..><sl:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-442E-../...G.m....I..1.I..P..@i..U>@...cu.

C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11928
Entropy (8bit):	7.0364135373096985
Encrypted:	false
SSDEEP:	192:qdK5BA+wDFCg8hwQ37tT4p1mBAeUkjxoav0km+r1:q45BAl58mQ5kjoms0klZ
MD5:	550D96AAB4DF8313DCE0EAD849AC0F37
SHA1:	1BA35D9E0045E07972575D1A7F045B8D652EF713
SHA-256:	B1273F19CF252840F1CC83F8C032EDD0364A8E550FC257161BB55222D1EE9E35
SHA-512:	764D01961C60053601BEFEF5F0EC8AB41EB3A88A5ADCBF549617551393F2F91940030020E3280A17141116BBDBD30EC02909C191A44F897BBB9F31E88F9EE4F2
Malicious:	false
Preview:	..G...U.m.....K......^I.~9aU$t..L).?#p..}..Bq$..Fp.o...I.....frg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{7419b418-ee42-422c-acd0-.&.....]./.A...]J.......h$k.'c.U.0.w\|`..s..K'}.zF....wr...2s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.G.....u.4.>K.......D..@.#.cZ#p...d.GWr.J#...~(..M#.x...PB...G(itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Standard2019R_Retail"]</./....\|.k....JI..B..C.\:i.va.TV/.~wr.D3..xp..Xs.L...K......tyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/.%......v..........c.5I.K7iI/-..V9.~n!.I....E%..gi....Xh....$.cYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZ.Z....{.)..+.gj...u.<..E.Gl-I.H...k.(.

C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20272
Entropy (8bit):	7.246057646543881
Encrypted:	false
SSDEEP:	384:/wNcCsq3yV5j0sgt0+fbZyyHCNqYvUBpfgfJhA:/WUuyVx0xfviNnvUjfR
MD5:	9105A0F6C756312904285307A4882D96
SHA1:	7222833A3FD42D5F41FE2D9C451DB6ED20C32C66
SHA-256:	D22D7B969B6698C4B81CA9F8B9B0FC81892D4C24AB22E50D863B872563702ECA
SHA-512:	7AE2230606AF7A6C06E36418C016E9F2F618E6CB87CBA78EC8FF2ED856D6AD2A5D4A54830FA1F55A4601CEA2970C201D4AFE4377D22AC119BB398B45D2DCA410
Malicious:	false
Preview:	.Z.j......u .C.X......{.(........=...W.......O.I.r$...]..,<...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{117a86eb-9860-416c-aa47-...4.....$a...N...B..#.d...X..N.r........W.S....D.i>....vq....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/p..y...ND..\.....F./.#......N.y...#...K...%O.I.r$dE.].3=2....:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Standard2019R_Retail"]...l....$h".O.E......). ........r......R....K...`14....c&k...ertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.orS.f.....Nh?.N._...............N.t........&._Q.D.V....Z.n5....YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrc........#b`.M.{...b.......!..L.{...V.

C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11483
Entropy (8bit):	7.106290029200989
Encrypted:	false
SSDEEP:	192:KD9iA1garBIkxMWPF1rkJ5W8dkG9i/XMOXg3hp4k+b:KxiSgcBI2E5W4Z0v/u4Xb
MD5:	9A243C8B2C767892DA4EBD9FE92E0BDB
SHA1:	F38BAF72A98C0B07B5A6F3A596FCD076655FB50A
SHA-256:	E1D7B0864B9CD4CBDE95D7CFCA83FE04601F172F55ACE2DE376F7F6FDA866EDA
SHA-512:	E51424C3672EC97243BBAFC5845C1DFD41F37A5BB6F220D90667CB26741E1F5437E06ABA7E98A939C2FE61704EBE2823C268CE4A0AEBC3B1C5DF6D631AE63E15
Malicious:	false
Preview:	..%B..#-....L.m<..Z...+..$..Uc(..}(......?!\|...7.~<......9Drg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{1739e241-fa27-4666-a0e8-D#....y%....B."......s..9..Vtp..d>.F....R6w%......Id..N...&.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/5D.Q.........0p....K.......Rgp..0n.T......k5..<.1a......cB/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .w.0.+\|....[.l5..W.M.m..'...v/..{..M....h((...7.b,......#.gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200A9.G..#-B.....<n..*.Z.].....vkq..\|=.T....5v.L...&..v%.......rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV.&....4W...y.35..<.H.q......P]T..&7.o..

C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	27562
Entropy (8bit):	6.621146328346024
Encrypted:	false
SSDEEP:	384:H6XXMsg7s6Px3g4OUzjNEb45M7NaXcj+eo5FydQ7gb6HdhJWHCxz8nXvT2j+5oeh:as/WMK7Nana9nyWopsHZ
MD5:	4ECABFC94D11BBD0EF0E258665C10A20
SHA1:	C77C4FCBF893D9476D1D99FACC7370E588946FED
SHA-256:	171C59B8C2B7F60FE8003B93DD7D0632C562C95857114BEBF2B52F560674B91D
SHA-512:	D87204B5C8DCA32545176759DBE546A15197588DED70C4B1B5EAFF4315580D7E0DA04035B76A0315E1543B0AD4A736516D9DF69EAF64553AB57E59FA4B8118CB
Malicious:	false
Preview:	..e..l\ .4!...w..F.i.!.}e....+H.@.YZ..W.w.w0..U.r..c!...%.@.?:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{df904bf4-d9a4-b9ad-1857-cdea671dca47}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x,{.S.yIq.76...h..@<:3.)4]....'G.q.Y/..'.'.s?....>G.g;.d.7.B.&.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office4CA376C1-6DEE-4AB4-B84D-0866C.S...Wwl......{....v/;.zr....,..U..\....d..W7Z.U.h..f+Do.~...415-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X3Z...@\|c.pf...\|...^.9!.~j....b....[..G.l..q ..R.1.. .(Y.@.x2c/TM/v2" value="Office19Standard2019R_Trial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://w6`.M.wC#.-"...w...%}v.s._4B....$H....X...w..gmV...}..5?.}.j.A.o<sl:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-442E-8s'...%wy.t...Y...F.v.m.ci....x.....X.

C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11940
Entropy (8bit):	7.069300173648301
Encrypted:	false
SSDEEP:	96:bYmmL0RAqaRAJDRKKmSfTG4o6vrqZHa1WbT/JxFlkOoXAWFF6+lvLrmDdQYpvDSs:FcCLDvrUDRlklFFJklGqBU4SkSFKbxn
MD5:	6B248A955A59339EE90CB868E06BABAA
SHA1:	46A2C69B68505495CD02A4EE8740BBDB1E6A50DA
SHA-256:	37113839F262AB9995FF94E0985A6C6E887FFDDD2573C50EA454A51FF69E4C6F
SHA-512:	699A52EBA26A48AE6C76E6DD3F43DF6F3145FD604E60E2A77929867A4C4350B9D6D99B03E564E3BF1E7A7D9B60121FDB545D26EBD7612082949C56BD265FBE62
Malicious:	false
Preview:	.A....6....8....(..p9...PU.f....9t.>.L..#. .^..........7.J..T..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f4f67b98-2451-4aa7-b62c-/.S...o..MQz..Y.x.-3.]..C.l...'\|;.(....'.b.W....3..%.\.....W..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.......7.V1...KF+..d}.Q.[.-d...';0Wx.8.Jr.r......V.........XH.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Standard2019R_Trial"]</rv.\........9....+..,3.J..Z.<...$ts/4.T.Do.3..........H..}.@.._..yPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2\|....t....9.ZF+...H.@.hW.w.Q..te.4...I\.d.<.......8......Cc..YlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZS........(...;)F...D.v.fu R.5.84WW!...r

C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	27870
Entropy (8bit):	6.75686863637035
Encrypted:	false
SSDEEP:	384:eyJ+rUsPaWiTHJqrY4ayPkX91vJNCN2zBidmoePEew3R6Wahxg5+RxiEsnjCmVw+:FGUrHQra1xNSzmYpwtxgIgjE8
MD5:	2D0A9DA4776D0EC74FA02EAC25E6046B
SHA1:	64A67ED81CDD3BA7F67375EA15E8F6F86AF6DDB2
SHA-256:	E0163FDBB8CD254E8CA21A2107DCDFAB50AF6BE4B3299344B1CB87761AC6249E
SHA-512:	45705DA846C23ACEE508D4BC2C8EE6732C1BE61FE277C94DE265A1CEFA6097C574B684C8BCC896D8DF94913679FA260BB189CB957237B895BD6D99A620422E4C
Malicious:	false
Preview:	x....;.L...[.y....I..U..E@F..../$..........Z......).....ym..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{2296c09e-7b6f-5f1f-d8de-3ffc737e4766}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.m.........G..f.....................e..pC..^.....U.-....to...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office6912A74B-A5FB-401A-BFDB-2E3AB.7..s...-5..u....V..D..FA....(1..........z.......,.\..=)..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.L.......OS...r.....0..H..DW....j..J..N...\.....Z..j.0..)U.V/TM/v2" value="Office19Standard2019VL_KMS_Client_AE"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl=.i...y.......u.......__..nvb...b......._.._...K..<.P...tk.^priority><sl:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E0.0...q...OA...'....L..q........?...D.

C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11975
Entropy (8bit):	7.041246328245084
Encrypted:	false
SSDEEP:	192:cPGBIrr+gP0Z3MOg9+SKJ94sr6kX+TENbxeTaJPKyh:anragcZ8prY6sr6cWEpc+d
MD5:	5A86310D7244F12E2224DD0B077D89F2
SHA1:	D7A0DBE430FC59A7CDACF80C0FCB1AABA3B1C9EE
SHA-256:	5EDE9443550D88D14F9B584C802452A7C4F93786AC17F5398A3A4E71BDE2DB42
SHA-512:	C959807356BCD5FC52ABA55B382B72729555CDE45E9CF6860F8F7EFC459092657EE0D87F5AAC34D9FA6386B650BA260C44937C7ECFE965F579171B7D9D75034B
Malicious:	false
Preview:	p.\|....M..n.hm#..dU......ztz.KU.}\|.G.n...\|.%...2......\LN..^rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{ea715dc0-0bbf-4531-8697-.....N..L.j.f&l.....].D.li ).\..2e<...`..D+.s..Y...c...;...Z...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...h..m.._.4r~.z..VG...'T(u.O..91l.3.>..TW....9.............itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Standard2019VL_KMS_Clien.....*..[.j.Ci ..6..Q]...''aa.J..Id .CCk...Z.%.....#.....THF.Xr:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www...._.....;.44u..+..QG.Z.''.@.g..^i ...m...n.<......9..".NO...UaIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQ...e..{z.B./=g..t5.mc.;.J(.V.n;.PK...kb

C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9964
Entropy (8bit):	7.10156606245098
Encrypted:	false
SSDEEP:	192:bznPH3sB05BrHFOE8NR/f3sWWd4lHYbzN0B:bzn/WirlRy36aZqzCB
MD5:	B86D5C6A97DB800362C047D5DA2A8101
SHA1:	BE8788A71A6EC35574F100A346578F2CA1160802
SHA-256:	7C7FCB3279B4D12D95B90F7C8F2B53CDEC9B8E09987370DA54C116B250FA1AB3
SHA-512:	8FDD735A9569E53C387524F522AB5C66B57033F96BB97968B8A89DDD3BA8D9E8CFE3DFB671271A62636289DE51C5A2AA016BAB632CB77BE431841D7CA256B2E4
Malicious:	false
Preview:	......5..'.....R...dA[.0A....C.....<G..3U.G.-J..p?.K.C..6..r...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{83187eac-d532-42a4-a2f3-..xS..j..a.>.WCD[.9K..h.....@.....*....7[...{...L..!.t.EY.f..Vs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..T......~.@..Q....p...9J....D.....z?..Rb..M.ao..{".i....t..}..r:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Standard2019VL_KMS_Cl..wC.....m.....d[.2...&\.....I....(+...1..F.3b..>:.~.M..+Y.n..\"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://..n...v.6.?.ES....2...&F.H..4...#<..QhW.m.%V..mr.M....~..Q...rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0q..He.. ...^.<W....8C(..b..'.. ...b2..t

C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10975
Entropy (8bit):	7.112505105642065
Encrypted:	false
SSDEEP:	192:wYnqQMsAFykwKmRpFZVfI8n1jB/BhKflfZAecfJwvmV2eg:LnfPAFlwNpFF1jRKfPA1Jwv/eg
MD5:	AA875A087402DFC1BD76F69F16393292
SHA1:	8EBF7C7E34535D9F345074F9AFAC6DCD53916B76
SHA-256:	0EE7692D9DFD750546630F9F47D0F611022A4967A0803DE21EE4583E12EFF1DE
SHA-512:	5D2FB598C8F7821EDD41CAB49C660E1E89CB9C27C7486E16D684FF1B685F8ABDACD3AF58370E132633CDF775A44438E44E5D44F0BF2919D104B530EF60CF0603
Malicious:	false
Preview:	}..a.'.Z.=.#>QW.%...$.@...\|1.$fb.p.`c.$...l......;v...<..5xrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8d6fef4e-0d93-4328-92b1-.o.h.i...-.50...u..uB....vb.3>'.i.(<....;.\|...,..........,s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.Y.r.-.z.d..bN..&....oNI...~>. >`.=...Xw...b.!....0B.......o~/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .j...2...).?)QV.:....<\J...tf.1a+.}."7^~...y./....U.T... ....,s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b.@.....^.~...LH.7...d[Q...]2.-...a..c.B..E.q....9{...t....7.PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4.j.m...R.~../.b.O..\.U.../,.v(s.5.=+.4

C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	27805
Entropy (8bit):	6.673200776124601
Encrypted:	false
SSDEEP:	384:zsU0sBX8Epv6WGUrQh00U36AW6NKfFwkTt3c5H/uTCO76cHzw0lW5wkkehXFCHL9:Ik6WOC7vdedTaZMOrvhQLrSw
MD5:	6FA8A53CC9C583F56C9029C9158B4353
SHA1:	D33E53C833394DA33932D91536BC1845EF193561
SHA-256:	1E44A3291005730B960337A3DA4206043DA909DDBEF500EA99F8532F889DE98F
SHA-512:	B677D021654C728B2B7E672E2B6243F8A4F2F23CF985009290A4F4758D85EA9F579BC06DD4ED9EC4F32458B14118632ED949EA4D00A906093FC835B826B4D08C
Malicious:	false
Preview:	..p........du7...}.r@..8[k]..y.f =....Qu.x..7Z$...}....0...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{7f6a4a90-f40c-fb45-4181-5edad70b859a}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x-.........-q(...!.'...l.4.G..u...L H..g..o.\|...2...*g.O..=....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeBEB5065C-1872-409E-94E2-403BC.......'.I[u;..[).m...?Lh\J..~...ny;.E.B?.X..eZ-..+w.D.t...15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X2......E.W+y<..A#.....;TjJI..0.../"r....J,.~..?]o..mW.r..`.8./TM/v2" value="Office19Standard2019VL_MAK_AE"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:/o1.......qhv..Ec../..$uH.[..k...>1v..Y.J .x..g.q..1..O..}...y><sl:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-442Em~......B._T)m...n.s^..:.tV..=...>1v..

C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	11942
Entropy (8bit):	7.052081604854084
Encrypted:	false
SSDEEP:	192:IYnqMF02Yq9HGKoy8Jt7l89/Iwus+MkO+3Bxk3Te0JjgluY0:bq+0Pq98zJhlo/IwQMkzxUTewjglO
MD5:	B9824FCD634A5E0EDB20915E6FBCF45D
SHA1:	BFFEA833C580DD204E4D3A9F1515B5634919AE0A
SHA-256:	377D0F0EC68AC9449E061DCC7AA359901C0B5BE1E43ADD738283ED76079BDAB4
SHA-512:	8D9790F8EC3A0ACE0385A00E02AC3B85C506E05321FCABE588869B84B5607119851F25519BA321D70240159F03099FFDC5C4E6A13E6379B56809864AF92A267B
Malicious:	false
Preview:	..h..n..~..FR.P-S.m..v...P.....Rj}.6k.A(..!.2.^......X.)U.I.Trg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{fb5ab6ce-e97c-4dc4-ae37-0..#.:..H..F}...g.v.F..Z....A.sk.i{.E&.N(.k..5...4H.f.s..J..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/@..d..l...M...M..).z....R......';.BiI.v.2r.>.H....r.A.x..U..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Standard2019VL_MAK_AE"]<+...N......PH.W....r.4u...X.....Aqi.b%..u.0z.>.......2...kH.H..rtyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org+...9..q..QH.Y3S....OX...U.....jq..b<UAx..-...X0..Vb....A.].7BcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrW^..."......Rt.]R<....CQ7..w.....]1M.w-\

C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20286
Entropy (8bit):	7.223055091900955
Encrypted:	false
SSDEEP:	384:cCW0SfUsk9yO/Qelp2DRlFdop4cYo6DVTITNeFC7:Yuyk/4D7op/p6BSNeFk
MD5:	64D4E564ED2AE2BC75FA82E35A658380
SHA1:	973621D01B44A6B674B6B5C376C76B174FBD5E26
SHA-256:	8FBBC691E723D306881B13FE84602236AAAF41751C21BF2CF5B87773F68E0F77
SHA-512:	B6EE2B10D24E0DBF99B2743D2909483CFDFCA531E27086B9B53149617DCBD4F8A24A2463451FF17717838BB7F8AABC30B83F2F14B6DFF87DF4E9A6DFFD1D553B
Malicious:	false
Preview:	m.....M....k..D@V\|..-Hk.............n.....=..2Q....$n.]\|4...prg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{ad143666-a01f-4c58-afae-.G....I..He..R..#.\|.3Y............:`.....k.zm..t..6..&y...$s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.-`....m..%07..CH?..f.b.........O..(!.P......2Q..y..n..m:..V8:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19Standard2019VL_MAK_AE".C.....yA.4.h..Y.."..3G\|A............I=........2...)."..C8+..%pertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.o..........^.u..Y..n..3:]:........."..}=.L..8...W....%.358..O04YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExU.(w......3.*..e0....<.K6..B........1(

C:\Program Files\Microsoft Office\root\Licenses16\Standard2021MSDNR_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10987
Entropy (8bit):	7.087791660149272
Encrypted:	false
SSDEEP:	192:ljjQp93+YWe5+b0fNJDep47XkHzPNBD2g7:5kf+Qwwf/Y47XcPNh2E
MD5:	512B9B4529A242571B26ED9C6F73C882
SHA1:	8A11E8BE05442DB015F926CD0707CEDA70DDA163
SHA-256:	170F963406E87200351E646758B4E9AD3FAABAC87C974BB6AF0C1664DA0FE8C6
SHA-512:	D944FF228142921D8BDB39D131D52B73FFF89147ED0D9B1F19DCE869969F61C5874D8E41E626DBB1F3E698C265A4A71AA3DCBC2C88E4404E2F25EFD5274FFF1F
Malicious:	false
Preview:	.L..\...c4....n-.bH..[..A....g...?...q?...e.[l...W.l.t(bo..X2.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c641ad10-840a-44c3-a47d-:.j.R..@w!@..!;.,......W....pB..&.....;...lI.>..~sMH,..5..[-.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..C.;..;qm$..3a.\|........<..cB.zD.."h\..1..C...\-{0).7u..Uh./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ..\|....Ja ....o$.~E..C...c...r...2,...+s...e.\i..y;gF`47r..[-.s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b>.:.....sw@...q...>.....i....nu........@{..:Dy8...U.zr1`0X..{0.PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4..L......w....[!.6...#..t....5T..z0...a

C:\Program Files\Microsoft Office\root\Licenses16\Standard2021MSDNR_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	27503
Entropy (8bit):	6.665369049707362
Encrypted:	false
SSDEEP:	384:fu/lmPsEUcDLY4dZcHuT0CNmBdpIhNePhkZfBasWvjwyKF5Nz5m7sOCkxt:YmPHDruFSBhEkK37wp55Ct
MD5:	E608870F3F55BCE13366A7080ECFFD34
SHA1:	BE546E9698A1F79CEE6A29F79B7D7C00179CD0FD
SHA-256:	72B534CFF43AB6B85AC18728D383C1725ED17FC968E8B42D77B4BFE61307B4A3
SHA-512:	F9EE02E19E4E30C3F2E77A2F17AADBCE2024448F524E527A167E82461CDC949B78D35AC1AD530FE232EB0645E48E101CE9FB3492D6210295556DA1B25473D14A
Malicious:	false
Preview:	Z.T"...a........L.)&\.D..Q^..0zq..+.....AY.&.....bY.(...o.b:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{a9aa923e-a55a-dbed-ae5c-e334a42b9986}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.O.m...0....1..6V..l4.B......?]@..^.....[M.).....-].b...m.{.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeC661E73C-8228-48FD-8C08-93571...]d2M-....."...^^.y<M.S......u}d._-.V....E.!.....z\..i.H.+.i15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.n.,.$7"....%..eT..o&A.K......f.?..d.R....G.6...A..b..._.v.W.>/TM/v2" value="Office21Standard2021MSDNR_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="htt...1Q..#........."X..$Bk5...u\|..AC..1.....G.......?...a...h.crity><sl:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-4...3.BJ?....w.9.#.)8.D....@..{l\|.Eg..

C:\Program Files\Microsoft Office\root\Licenses16\Standard2021MSDNR_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11944
Entropy (8bit):	7.087383193539061
Encrypted:	false
SSDEEP:	192:8f2/DcMO2PJW67pLCHsJkgdPiA7JtXtYOQgfGuRwa3NfQVg:8f2/AMOQW67pLCMJkgdPimNt09bpVg
MD5:	93FBD28E99B789DFD5163FA71924CE6B
SHA1:	8C0780AA45048249EC02572E0D2B47D9C0CC7B86
SHA-256:	414862AFE98B6E113C9C4AE1DE64D9210971A4F7F8D87EAF162A9BC0427C803E
SHA-512:	EB49DD6240F85E51CD66597338A550822BC606E6813A023842698DDC3C02E432C97EE8CC15335D46008CEC878BF82E229FD21CDABF5C194CC2A338D28CE45BFE
Malicious:	false
Preview:	..Q..B%#...7.d2..8..I..{.+t....H........0{r..`.........K.^<.0vfrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{189fd1b6-f2c9-4ea0-9c5d-3...\^y{.N ..+$..g.....7.6~.....\...I...>9%..9....9...u..q:3i2s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/B/..fH....*...9~..{...p..v....JT...b...n)Y.l....]....R..mm,?(itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Standard2021MSDNR_Retail$ .L.)!.....y9.`..U..g.".....TZ..A.`)c.G....W...._..m0du.opertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.i.....x...Gj.g8.n..U..F..u.........A...yz+.`.........h`#.\|jz4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExS...mu.{..U...Z;.j..8..P..C..0.:......

C:\Program Files\Microsoft Office\root\Licenses16\Standard2021MSDNR_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20288
Entropy (8bit):	7.207284902398543
Encrypted:	false
SSDEEP:	384:HcK+AeMHYlo2+y6ibGp0j4FSGp6CUJhvocoARNRX9sdo:8K+2YlUyXb0JwCUzvoutWo
MD5:	D752E3F000D8E88F566DA3D956A42DDD
SHA1:	D95C266828BBC79169498AE0E764212DF6EDC4BE
SHA-256:	658B60D23CF01648C61FB8DDFA84A7CDEF487C8C704E206CFDF4341F8613F934
SHA-512:	6985FBEE37567A991CCCBF58ABDB408DD21512E53E6DB600EC2EFBD3EBD6E37D9FED41E836F46E34D778B0732EB2AF2C625B0C30E53CBCB8687DAC30C45CFDA5
Malicious:	false
Preview:	"...z.=:m.}.y.....Ln.p..M.....5....b&.y&LD...n..p.+.I....f.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e3da42a0-d0df-485a-b62b-.!J.'B5gy..6.2\....dR(A.[.....p.....l".;qE.W..R.....s/:R..y.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.Be........B.fN...XH$.........7.....-p]e$Vd...n.....+......:.:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Standard2021MSDNR_Reta.\|..y_"l,..b.U......7N>B.......{.....2jsg-V^..a............g.propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w.>G."_bf}..?.?.....9.rB.\|......v.....2\|Gg4....6.._.....A...t.y6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRl.h}.......6.R..../=c./.h...;..T......r

C:\Program Files\Microsoft Office\root\Licenses16\Standard2021R_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	27431
Entropy (8bit):	6.706885424635518
Encrypted:	false
SSDEEP:	384:/XMsiCdgdnqDh16i9nrdNGN10ciWoDC035c5unugaFSGnVv0ITcwLp+i98H/zL+V:EQgQh5nrd8DifJo2+p+iwP37j+U2
MD5:	3A05FB23A223E9FCCDDD09E2BC1E930F
SHA1:	30C6A2E3A0A0A8831634FF087BA888195CD762E3
SHA-256:	A197B0A62C6E20B71792946D619BBB738385FF157241BF0D8B1B68D25D4113CB
SHA-512:	45D2C53F2A05984EE9F853DA809A024DF7375D75A994556A6BFC096C260D9DF001E066463878EED4E8E92586F6694F14C2E4F45E01642E1761731D2A7F68F2EB
Malicious:	false
Preview:	.k....H.......4..`.....'s.N...L.N.%...,..0/.?..0Me.x...Ao.W.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{60cbe5c6-cd51-47f2-2f47-b112936ed61c}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x........J.......,...%.]V..s)G....}/N`_...\|..4 ."..\|..b.RSb.R..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeDEDB1F56-3197-46C1-909A-317B7^.s....8.E.....e...0.....&$A[...Y...;C..?...(.m..R}.r..X.+XF.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..........[........&.....0'_A...LLZpG..7..6?.7..sZe.R.G$?$i./TM/v2" value="Office21Standard2021R_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://w..n...........R....! ...VR_.......wB..,.. r.a.?Fd.f...$.\.<sl:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-442E-8^.r....Q..P.[.(..1.V...*y.`.......w_

C:\Program Files\Microsoft Office\root\Licenses16\Standard2021R_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11943
Entropy (8bit):	7.071834852605486
Encrypted:	false
SSDEEP:	192:pO0ep2wUdRumBDfYkX1Y5OEyQPJjHn70c/:pO0eswzsrV1SBJ770c/
MD5:	8B06F65A270FAB287BF2BE4324159B7B
SHA1:	8C2F209F22D515D809664BD414ED81E6EF218666
SHA-256:	FBD59B78D55618C5FC5ECDA67F007707AB69BB4F3B3AB7EB3BF107A57DEF7EC1
SHA-512:	99F88B8A28D68E4B053CC2190FCD8EA25CE755402341B37AFEE8C609B486574CB16E17D2645AADD4898140FDEEF41B41360E6DCD8F85EB2AEAF183D300652D51
Malicious:	false
Preview:	......LA..#..L<.8...;..`....u...$^..w..8.1.z..=...6o6..`......rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{aa8f96fc-5d78-49b2-b7f6->.s.J^....v...s.h...1.A8J....v...=HG.g..6@f.,.u..9\N.........s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/L...p.la.....Sa.;.....Mi....r....a.w.uY.fP..u..+..]!h;..#......itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Standard2021R_Grace"]</r2.$.E.dU.#..L<.;..1.Vw)...i.....TN.#W.J.;.+..(...S#e.0......yPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/28.z..S.U."..Bp.;...J.\\|>...%....%TW.kZ.mF!.~.....D.Sh..9...(..YlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSG.~..Ac_..!..F..V...F.j=0...A....iAF.!a

C:\Program Files\Microsoft Office\root\Licenses16\Standard2021R_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10971
Entropy (8bit):	7.130387541142961
Encrypted:	false
SSDEEP:	192:h3HS589DDqULfLC5JO1ThHP5Rf8+0n9f2+bVEGZiar:h3HVDhLfLvhv5RU+652+pZz
MD5:	1B6B64E97CD7B27E85B8CBDC756989FC
SHA1:	1CBA3C7884ACB077F236E882D244BC0006A1B2CD
SHA-256:	67944B8BAADA157035E3F1C7751AD24100B22E0DBE1BF626AD2894D97E4A1B2E
SHA-512:	AA0AAAEB08C7A6A201FADF660EB1B45133F2AD3350019FD52606DF513B829E131D35162907B193BEB984CAC7C22DE16669D1F8D2BA7FA2B03CA74B1CB0DF8E6A
Malicious:	false
Preview:	....&B...1..VR.U.....W....A.2.....u...6.f..(....../.L....X..0rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f9ffa904-b367-484b-9a93-\|\|$.)...wP.$......N...v......%..B.i....8.1..q..........K.L..ds:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/....AH...h<.vI..V.....'..+.N.6..J.9.8.H.y.h..a...8..8......].E6/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll 3%4.xW..%..=VS.J......$......'....Q.!.A.4.s../...a..$.X....L..ds="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b#.r..i.rX..KM.G.q...?..$B.;....w.u.}.^.O.....*..9....&.M3.[PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4.%..rp...r..;.g.?....O;..V\.`..2.M.=..

C:\Program Files\Microsoft Office\root\Licenses16\Standard2021R_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	27434
Entropy (8bit):	6.70694416071417
Encrypted:	false
SSDEEP:	384:F9eFFIsGWCop9lHvW9P56ceNyEwjDmac5quLFXRzwg0weB8+yarnY9KkUHtoLnC:cI3g9APR+XwCCtBVT1to+
MD5:	AB3C83A007B415DCFA659CB3A80E73E0
SHA1:	FAA53C747A264AEBF77D582B20618C2DF8EC5623
SHA-256:	485F45CE15AF0825FC78924440F7E5E776598B12569DF5C230D6A76B04CAE3A8
SHA-512:	ACEC81B694C3493C9F8D4A8CBF309F8A1A26758052A8802C224AAE89CD12FBDCA50FF6297A87C8D758C33184CC35590A351D1B5613EBD206F3BFE96EC6B2DB8F
Malicious:	false
Preview:	6.";.....P...;W..........^.,.l..J..W.3......i.S)k...F..3...g..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{cfc378a3-8149-2498-5720-2fba1a304049}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.w.t....S..?H..............xT`..{..".!.X...f.N`}.H.B..y...e...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office9E7E7B8E-A0E7-467B-9749-D0DE8.].0..zv:..;[.........]..~.k._.^Q........n..)b...C..r.#..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.V.5...\.\..7\........_..`.%......{......y.[. ......D._../TM/v2" value="Office21Standard2021R_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://.l.)....EU...\|[.............K'....Y..\|.....s..j>.Z.F..{...{..><sl:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-442E-.).5......H.g..........^.!.....Y..\|

C:\Program Files\Microsoft Office\root\Licenses16\Standard2021R_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11928
Entropy (8bit):	7.095752115109039
Encrypted:	false
SSDEEP:	192:UVOmlSsfvlGxU/nobi3dhacz+MHg2YF0pAHUx+EK1Zi:UVOmg8vAxUQbiNVyMAOA0UEK1Zi
MD5:	5651469BC8CC83D832EAF16EC84746E0
SHA1:	7F41361F933236BE9FCD020456A24D9A86E26C80
SHA-256:	BF5820A9EDB65613658C3E5F6D1A227C84CC5C609DE8ECC078D69E18E4EB90F4
SHA-512:	31F7F29E5E12C5C2940C4C45E35FA60A7B32385C4DAA049B71ABDE9129099ABDCAC6B6DE4A2B131E39BAFE89F8E478EA3DFDB473BAA7C9CC5595213878F06B86
Malicious:	false
Preview:	...k... V&8,.9.0.f.K..4...S.M....J..,.V/.,...cT4p<........rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f6cff8bd-537c-4d49-9e7b-...g...y.bn=..v.`.9.A..l...Y.........."..&.u....J>.Gd.d.....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.qwx....D.....d.3.%....=..Q.......>...r.}\|. ...C3}%.T......itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Standard2021R_Retail"]</..[9..... /;.?.c.k....>...[..J........b.Px.x....owd!u.......tyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/...g..c.=1:.1./.k.(..4...[...L........Q..b.-...h"4Qx.~....cYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZ.lsc....b.9.5.@.d.>......u..C.......

C:\Program Files\Microsoft Office\root\Licenses16\Standard2021R_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20272
Entropy (8bit):	7.188935165200209
Encrypted:	false
SSDEEP:	384:paoQR9zs/A+ID4yIhtKcb7aaTJnPkoeEBtQ2c4N9MF:/QRX+C4yIhtKixTJnPssnMF
MD5:	A0C45C750DDA1F73F817FD4D2189A21B
SHA1:	63A8BCFA8D741CE459E3D32DF4E6B22D7ABA4AB1
SHA-256:	04ECB2D1D7897C38F59740B4132B4B7A2770F88EDDFF1CE178835973749B6A07
SHA-512:	F4C84036066FC7A70C24BA7542157DC4FC6E84A10355352058BDF09D1C2B0CFC718F0F060670710712F91AC532EF9634B4AD13A913AAF7BF1BD2FC3161961DE1
Malicious:	false
Preview:	.H.{`G..dl........I.d%t..w.K....67-.2.....@.#.71.N .O....P6!.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{8f0f0c44-cf1e-4a6d-8434-..l&;]..Vsh..........5},..j....LPy.;.."...@....q...>$....n_.D5>.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..Dh.M..=].E..^...]./q}.W.D..L.qrk..0......`.#.71.)z.O.Q...d}.:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Standard2021R_Retail"]..{}>Q._Wq........Y.iw+..j.N...Ey%$..\|.....M.%.{#.y;......L*=.ertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.or..;wo....=q.......Y..VP..a.C..L...$..\|..........:.=c<.H....En(.YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr..Z......P{.;..1...4..@\.. .a..Nmp9d..i.

C:\Program Files\Microsoft Office\root\Licenses16\Standard2021R_Trial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	Dyalog APL DDB version 9.-49
Category:	dropped
Size (bytes):	11483
Entropy (8bit):	7.091916559230643
Encrypted:	false
SSDEEP:	192:vs0gyjdUDLu0dwgGyz6qNcQs9aCYT+YG9S91aZ:vZgyqXNfdzH1s9VYpG9S91W
MD5:	71D25E1A5846E0E9B7A3D8A1A79FA0D9
SHA1:	B0B7F2F2DE854CD69269F30E8B6F1FF2EF07DB24
SHA-256:	961E9F220EE1356F4718BE63E71E8C027104A99E2EDAFF5AC7B3843675F66CAA
SHA-512:	E7D8D731EC70AFFC2D9B473AC5B0F8288079659D29FBA82D993F268C0E29FAAF698776DCE6061B4406DB94730BF9E367CD60CDBE1A8A400B1D3D16E0AFA484AB
Malicious:	false
Preview:	....3Px.Q.O...X...}T...!).....*5u..d..3=5:..6L...O.:E.'..z..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{59b51424-18bc-4269-83ed-w_..?.t[C........".._'ye...\|=m0..r...=9;x..`....y.Pd.....7...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.i..TZX C.~.......>@XE+("....x.mw.."...`jz ..=....Y..R.....{.../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll 3Z.mEpQS.C...Y...pU^.9+5...-?21..C...zb{...?....Q.?V.3..x...gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200u...#Px...C.......1IU.%+..\"l"..q..HeS{...\|...w..E....[....rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV6..t_P...n........0[.%. ...z.I`..{...`

C:\Program Files\Microsoft Office\root\Licenses16\Standard2021R_Trial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	27483
Entropy (8bit):	6.643718606704925
Encrypted:	false
SSDEEP:	384:0X0shqkDx12y4ThHiF5aQCNqe88amTePUsjmKK9g/dFC8H4ugcVlrIEe1Odv:lWWACQSnham3kcg/7LJlTekv
MD5:	0A3756CEF781CD918C12CF5FD26CA4BD
SHA1:	1323DACBF446951A8F0B540D0C855C5EE6B06942
SHA-256:	D11FBEF8C7A8ECA9025AB2592B2A03B5F42B9D0450D71A4B0CD1CDBE40AE8D18
SHA-512:	9B114913BDDD42BEFD53A6AF9C3877E3637960B4C5FB4916D8810D742B2F46969A2921D403278C2BB5C5677B5BE1FECBAA9D8C1D589703FFC3E411065C7E3400
Malicious:	false
Preview:	P.......'.....<..o-0.....'<Wm..tHD../.X./.;@.v.._..f..\|..T.d...:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{26b330ee-5632-c167-cc34-163327a973cb}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x./......%.9...#.wqn@..Bvc.7D.xGc.9/."._tkZ.r..B...Ox....v....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office73DCB0E0-5934-4977-9D2D-522B3..R...).W....0.>y".....0?V:B.s.C;.v.F.}.(..V.....\|..y....?...15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..)...!.q.i...7.$spl....(=@9\.=.A`Z-...?J ..p..W._%..?!.#....../TM/v2" value="Office21Standard2021R_Trial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://w.4K.....t.-...<...NS....4v\|`HQ.{H.f.n...xH;..f...Mi......+....<sl:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-442E-8.sW.*.>.......s-".....+?Zg..'..f.n...

C:\Program Files\Microsoft Office\root\Licenses16\Standard2021R_Trial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11940
Entropy (8bit):	7.068484767243397
Encrypted:	false
SSDEEP:	192:gIxXDMNkUXO23iFqTAvjpGbIcpoiChHbPAGc9tf3OluLkU9:gIxYkAikTEpYKiEiPPOluLT9
MD5:	B7865417189F3437F12302CA82D0F789
SHA1:	C6C8349B2328F50DFC4E35DFE000C74D8F9F80B3
SHA-256:	DD7E83EB18B76DA384341BD4C8283BC982704AF351CB7E97084E79AAF6DBF4AE
SHA-512:	2A4F304C7BE500F52CE1233B8D3F0AA1B125417C31F8EC020621F4B882BEEFEBC8B902DE369FDF21214E6E20E605D7352C4EBA3B1DC4A49ABA4E27BA829E451B
Malicious:	false
Preview:	D.s...>..).@.LU.....%}......R].UvV..h..." ..-...i...j.t.m..N&.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c756bf5f-76a7-465d-84de-.d....0Z.=........../,.......E...o@H.x...`w..tG.-_.\|.].J.7..M9.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.......%.p..LS.....a6......V...3.x.j..p...!...:...g.m.<.CRo.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Standard2021R_Trial"]</r.0.m....@-.A.LU..../9..........RC\A.<...1*..f...s.s.9.>.g..E'.yPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2.a....\|.]3.A.B......T.........-.Dw\X.t..f0..'!..t.#.4.M.#.Xy..YlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZS...........}.Fx.....X..........v;II.>.

C:\Program Files\Microsoft Office\root\Licenses16\Standard2021VL_KMS_Client_AE-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	27791
Entropy (8bit):	6.677954556316582
Encrypted:	false
SSDEEP:	384:V7WtGs3aS8pxfku+Bf5qFs6kP7h6NmXIQp2Ec5guiOFTTBHCrWQCMprwW/CZyj/Y:RyRPIi29BuxL9jp/szFP
MD5:	5B84D21E0C348CF77644C292992EB35A
SHA1:	B27ADBCA3C9240EB4218A122B4B0B8F206C7142D
SHA-256:	EC23884116DB604906BEC7AB71581C29D86E5F6F21C166B2805A266A0B1E7740
SHA-512:	51CDBBDDFC187E5305439A80A831FAC2DF3A95F263A6238A79FB39CD27BB934EAED18176F722430CFB9B95D84C1F3336C9729AC98F2EB801F4E8C37EA3AC70FD
Malicious:	false
Preview:	.~..o..iN...l72.#...W>....v.<x..m...?..Q.[j..L.U.....V.,.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{26fba663-40d7-f18e-4a69-e91b4df94bef}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..j..z..kM.6..s<h.......a._..z..I......z%..^.F#....Q..5V.[.)..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office080A45C5-9F9F-49EB-B4B0-C3C61T.1..S...h7x..`<a.w.....@=.R..q.;m..k.^..9u..V..j..S.P..>\...=.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X..H.C..?.Qf..g0{.}....X?.Q..?.96..".Z..1f..A.Sm.[..$..C...../TM/v2" value="Office21Standard2021VL_KMS_Client_AE"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl=F.p..-..>O.v..`+`.}.......!..9..>....[.f9....Gp..].@^.u\.[.2.priority><sl:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E0].).%..q.Cj..2.:.$.......o.P..'.9c..6.d

C:\Program Files\Microsoft Office\root\Licenses16\Standard2021VL_KMS_Client_AE-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11975
Entropy (8bit):	7.054163375576201
Encrypted:	false
SSDEEP:	192:mPSV0l77/RIWr333DJbp3ado/n8k2S/eriojNnGQrK:cSVu7yK3DJF3i4n8k2SG+6/rK
MD5:	38A23C28BFCDBB17E29958385B36AABB
SHA1:	BE5F10FA8888BB98130E57680A9F27115DD3DC83
SHA-256:	5C9CC0DB2BAC8F776652DCDDBD9CEB8E686132A7D63924F299D45EAB66618208
SHA-512:	C45759805AF77FA97A5980945490B0B73DD754EAB5092737B6E3BBA235B248283749C5F60C99BDF3F5B8F3392DA5B2BDB74A84598BE94E53477BA9FBDBB2E1B7
Malicious:	false
Preview:	.}l.\.B!v..9......e.....Jt\.iH+..ZD..?A..U5l.....o.f.+.O...I.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{dfcb5029-80fd-4723-bd8d-w.....fF.s..O...:.$....bA.:K<.O.].../O...beJ...,2F.G.s.<....V.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/....;.b.dZ....]...&.j...A)\|.fO/....G..=.M...?....W".a.2.......itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Standard2021VL_KMS_Clien5...A..b$O.%......&.m...J)..r.*.Zn\..oDD.U.:....9k.q.\|....T..r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://wwwo.....HbdE.{.V...8.m...)..Sg..QyQ...#Bo.C':..?.<.L.=. ...t.aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQ....6.x..:...D.....Q...iD..Ek...ws%..GM

C:\Program Files\Microsoft Office\root\Licenses16\Standard2021VL_KMS_Client_AE-ul.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9964
Entropy (8bit):	7.0402876946620125
Encrypted:	false
SSDEEP:	96:tc3mb/0Uz2gRASIbROmm/qMBKBCGWln3eapRtk0/JOPvDYVL1FZTAqYAaaIEm4eS:VHw1TGqZaY+OPbMNcqM0ebiKIGCl3z
MD5:	E54D1CB179C88C01D0F59028B9163841
SHA1:	3A9CBBBE6AC7EE715C7D86DE802A1D5D0C9FA113
SHA-256:	CCC7EA79DCFC82498F4A09CF0BAA78BA01E295186142C3C2038CBC3255F1455E
SHA-512:	110D3F759F9D4E509794907EF56E6BC509ED76753DD408CAD62126A65D1BE9994A5D0B8D82E4BC5B0287E1A36E0CFDA9CDED99829C018673953B6EEA7B9498FB
Malicious:	false
Preview:	.gV?.%.4^..yCW.0.1...;I.D.bW.=8..6R.\|...K.;.6..R....B@..i.....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{e628dbbd-5a23-4f40-a998-i..b.?.:G..oM...`.nJ.c..R.h..`../<.Jl....S2.o.En...4u..f3....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/N..,./..L..F.H..3.r...o@...`X.9`.sla~..L.d....Y...G.e.W}..[..r:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Standard2021VL_KMS_Clc..w...z#..y._.`.EA..~_.N.h..uw..->>A2.....n........)LX..3...."><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://}..-.n.7..9....=./A..._.@.$...V..'5)L2.....n...O.....B.]r.....rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qX..Q.......X.w..4.BK.\|c.D.Km..@...t'n..

C:\Program Files\Microsoft Office\root\Licenses16\Standard2021VL_MAK_AE-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10975
Entropy (8bit):	7.139571062124261
Encrypted:	false
SSDEEP:	192:v2Y6JSvnLr1uW2IZoK2MYAEvUJKtx/OLFcl2SIpkqxKG:e/QvLYX+or7AE8Jy/O9prP
MD5:	7C68D29E61AAFEDE9C32892BD50E5A33
SHA1:	232B1383CF9422E639C20FD207F75C23EB2F3C86
SHA-256:	5F1CCD584AFF2222E3176F259AAD362D0D993BF8B70B04BB643BFF72E1994F36
SHA-512:	4E0D20562A426E99C014AAFB08A76601C9D2714895D231A0875E2D94E3A76A4D4F9EE9802E8DAA4F83A42D4CC571AC34C8DA7A600FD76F33A2CF153DFDEA1279
Malicious:	false
Preview:	b.Q..S*!....z..}..I"..F..[..?.43.g....g.)...x...E3.k6.mj...w"{rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{17d4ae4c-1658-4522-b8dd-......su.\..t..k.........M..l.#k.(.._.w.-.........s..J.\S...t=/s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.6..Y...A..&..1...6.......0.0k. ..j.'.~....s...S8.\|yYM?...zx}/r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .....F"p....m..t..D#.....y..hR!4.w..U.!.e...}.......`..q?..t=/s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b./..x.%.[..Y..]..?@.....s..< =\.`..w.n.V....#....A1.};A%8...T .PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4.....a!).[..k.q../#..^..n.."/f}.X..J.v.

C:\Program Files\Microsoft Office\root\Licenses16\Standard2021VL_MAK_AE-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	27726
Entropy (8bit):	6.6882573332884885
Encrypted:	false
SSDEEP:	384:crPczMslLCYJ1lrgC4RcCqbnqSP9Jzlp/9cFiQjSeeyTerClNzIwi6Qh/tWib5gg:cDZ4GnlRgqILTlcBD9c6IVp
MD5:	E5BB6E707B30846039F64FD5625EC112
SHA1:	1A111308335A84DD453E304630AB12F8B1566654
SHA-256:	01940F42B3DD3EACB56F83162D22ABDF8C6B9721BAD5D364778709A98CF3475D
SHA-512:	7A28AC4D83CE4DA3072D7497C0E2104D2AACDE9C3059C242950DD9CBF714CE8F68E0085798EA5C65DABE9A811345C28E11C912F7466737647676854DA05D5818
Malicious:	false
Preview:	P...!p.c.i@..H...$.L.F.v..NL."D..D.9......us.......b .$..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{309212e5-4373-3bf6-95a5-f662a5feae16}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x..}.$e.2.jW..L...<.......'D.....K#.n.L...E....zx.........(h.'&...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office223A60D8-9002-4A55-ABAC-593F5..%._<./.Oa..H...u..S..W.a.....%...L.?...,.Q..r(.........#b^n`..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.._.1\. .-..D...o..5..[.y.....k.....v..{.B..ey.........}`z.../TM/v2" value="Office21Standard2021VL_MAK_AE"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:/..d.0e.l.pV..U...k.....{.X8..q.0.C...r...d.N..bo........( Qg#..y><sl:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-442E..!.,%.>.*.....A.6.M.P./..KK.f/....r..

C:\Program Files\Microsoft Office\root\Licenses16\Standard2021VL_MAK_AE-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	11942
Entropy (8bit):	7.061187045965516
Encrypted:	false
SSDEEP:	192:krnFGXqHneSeUr0hIPrZu9mya2CneAJk5bI:+FG6HnVeU8ArZcm52ZOk5bI
MD5:	6985452A5DA30B13082E1FAB09903B70
SHA1:	0C7E3C1C29625D5ABACEF87CF0C98E2610698B11
SHA-256:	BEB4212C3B8ABB30DA3B256AD03D48A1D5B9A8E6BF037B2EF233542FB33B5BB0
SHA-512:	4C39817DC9A0840089222D6E2027F020A558818B66B4AF59B5D92F52A666E0448ED3BB5F0D2A1855E08F11455CA90D3255FF549F16337E2A3069CB998FB048A9
Malicious:	false
Preview:	.u9...?..n...O`~+xn.%...'..s..r.&..~.YbMS.:,.-..z....Z.kKA.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{70279380-7b24-49a3-a7f3-a..D..g..(..../h{61L/.M.k.. ....?...n.]l...lu...9.[.A.....H^.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/@........7..P=2(f-.a.A.,...\|....c...\|..<.x.5 .~].}......(W..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Standard2021VL_MAK_AE"]<+..G..?..`...U\|yy4a.:...&..v^.=..=...0..?Mz.; .....l.R...uJB.rtyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org+.....b.`...Ufw5xa.G.t.,..v..q..=...).Y2~].!.....9."..k.1_..BcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrW^..o..k..j...iBsT...S.x.....X0...}...8.

C:\Program Files\Microsoft Office\root\Licenses16\Standard2021VL_MAK_AE-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20286
Entropy (8bit):	7.190631287917855
Encrypted:	false
SSDEEP:	384:sb2m9ubUdybMW3DJsfe34aGYa1sxsEAmRFaH/ahlw:KhubSybM0z4aG1zEriSw
MD5:	790369FF2BE28F09825A5FA52B6FFB43
SHA1:	EAEF739400937537530BAF97FE5401BD76CA48D1
SHA-256:	C2AC60403D2A04C6728E0DB248D8F0D80BDC2C44FCFED85493C785A600234DDC
SHA-512:	D86389D9C453B5149CC0301823ECE02D6E0E827167D9516701170D4BA9CA2A38B8CAC822F27E324FB5C80CDB6EE5BAFED92BE806AD0865B23DDDF34060BDE54B
Malicious:	false
Preview:	k;b-.."yY.SY.lHw.=qj...(..,i...8y...Q3*.x.\|...A=..>.......rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d9742e08-3edb-44a2-a8ab-...u..vw...M.'.a..b,`...>...j...w`.._7$..q.%....hW^.f.}.....Rs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..>...YK.bf.s.;.~e.....u:.#n...<....ey.b.\|...AZ%.>.B.V..N:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office21Standard2021VL_MAK_AE"..c..!M..sS.wBj..c1d...-...k...?7....a6.0.t...E.}./....E..SpertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.o...#..:I..S.iCj../}d........f...s1....xe....#...s5g.z.`..6..F4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExU..B..{!@.tY.T@V..N.......&^.D....>.....

C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10971
Entropy (8bit):	7.073911552453545
Encrypted:	false
SSDEEP:	192:IKPH/IC94hLEx8pAunAsL562hxKHtbqcYTjQZFAb0T:3PfIFGx8p9/5nLGbJGQZFo0T
MD5:	3767BEB0955720F3EAAAD27AEE534186
SHA1:	E63BF451164E976205AF43AE90FF264C41526611
SHA-256:	D8569AFEE39BF6C81770234DA6CD9A1FBAD0660D3BF874B09EB7B8E34ABD7CB4
SHA-512:	EAB6FE9AA4349E0830740D848C33DC23782F5E5138A0B2993A2AE2C13552C0FD662662A4E49BBBE40DD7B26DCB0867C7857056F935F94E872D3FBEA8629E6BE2
Malicious:	false
Preview:	........$...(Ux...==........;l...y.l.-M..J}...[mk..+......o..Nb.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{a3c5a5e6-2085-4d96-92d2-!jn..@..`.&.7.BJb`.G.....ho...6.z.r]..D?....?#.......5..M}Ss:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/P[....26...tJ%...~)..K....4k..=O*.`.HQ.g.]..Bg.. .....u..C8./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll bh-....C&...?Uy...0<..Y.....l>..i.B.y.AJH3...\ha.W......r..M}Ss="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5brBk.."..4....Hg..hK_.^....>8L.~.d.-D}y"6.V.y9v..)....X..m`lPKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4^h..;..R...9.M.xP[<......L&C...FH^.e\.

C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	27498
Entropy (8bit):	6.611339794978316
Encrypted:	false
SSDEEP:	384:W0v+PsCwzvXk4PZQ8I+8Jd5CNOLwxlePB6pQ216HSIHZGCYOqxMoG7ikDT7gD:W3ETP7Ihd5StxCZHpHcCHfD4D
MD5:	A711F7D7C72FE916A03E57AF42EEC838
SHA1:	ECED196AE9A36A5C576FD3AC0FEA2CECC1357AEE
SHA-256:	C09141B5C34C0E6245FD8195F488F46EBA9DA2ED4E52A6468DA5FCAC3C0240EB
SHA-512:	B071191AED75E8310875D696139958C04E15AB44CE7F48435CA08FA4363A470F8ABF6DE703CB1723D9D4CD5582B2CEB559A9422F33BF6F6ED3D586C8DB2D7F77
Malicious:	false
Preview:	{`...9.#[..p.....%..`HI......xn..1..T.v.C.7..Q.yaw(.cv5c=.?.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{3607b3cd-3e17-ab21-3c3b-15724c30896e}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x...K.,.rY..l....=.D5.[V....,9.....Tp..3..-..Z.co-2g.yq.+/.:..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office2395220C-BE32-4E64-81F2-6D0BD...m..o+..".....t....S....{..6....h...}....*p{h0.i;t!f....15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X......`...<....n.Z..I......4a..4..VJ#.S..n..[.-2"`(.IWB>X..../TM/v2" value="Office16StandardMSDNR_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://...E(.=...d.D...(.f.E1......Z&..f...Qn.........i,} 6.7u}xo..9.><sl:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-442E-....p..N..A._...%..lE.....up..0...Qn.

C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	11924
Entropy (8bit):	7.106482049195549
Encrypted:	false
SSDEEP:	192:jRqdq0yN1kmBgMldozSXtvPY06g7mHyIFSb4k/AxssqMF:jRgyArg2zYdz0ysR
MD5:	49085A886E43B2FE32DEB6AEECFC6623
SHA1:	BA41CA8200410CE877AB20D27654169CEE413720
SHA-256:	FDA10596F310AE7846BD41327693CBCFC509A81721292CF968AEB486FB3E378F
SHA-512:	35FD4EFE649D91A039C93F64F580E4C0C7E4667C51E7452DE3B264081EE528779AA13945C13631ACBA2F5851DD68099B8A1F77DCABAE047E605716D105163D13
Malicious:	false
Preview:	..B....n..a..p......^.o.+.....0...#..'"...h.....E.;..U.Y.....0rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{130fe507-d6b3-4ac7-9f7f-.2.....d..<..;..._W.T.7.g...@.'.].:..x2...].....y....b.g......ds:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/1......N.WP..o...K...;. .:...4...a.S ..I:!....N.v..X.@....~itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16StandardMSDNR_Retail"]</.n.K...G..v..j........).7...D.%.\.%..s ..YT......[.7....[.....xtyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/Gd...P.-..h..p.....=...<.....i.w.3..js..js[...d.0..t.H.....HcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZ&....Y.@.JU..T...`..+...}.6....@...{z.

C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20268
Entropy (8bit):	7.236790719791672
Encrypted:	false
SSDEEP:	384:+DdeWBq1cyoOe4hOSoLq5rGHgNU/IUvsHg:Upqqyo540e5rGH+U/aHg
MD5:	E30B6B4FE85D6B3B4151FEE3078B7C60
SHA1:	3E92F71A036141E57076AA00DDE92946777911A7
SHA-256:	1E0072820C3A4B8914902CA474AC48AE268B505224557A24B0BC931257604A26
SHA-512:	1DA6592DACB170B30CFCA1BD668DA99F7CEDFB68D07ECA2ACAE025CAE2DF61FE6647A9ED75EA632E2314E20D3816B72947452D01E0ACACA8802D28A1A2FEE4EE
Malicious:	false
Preview:	v.(..q..omS...`...."GC..R2 .g........Y...ty..#M..s..#.0..,L..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b2f7a5b8-5cf9-48dc-82c3-.3....z..{m...v....s..E.O8s.p..U....W..#p.q...Z.<....XaX..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/......Q..6\l...,....i.J..r0/.c..^.......vc..#M..s.G..".."....:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16StandardMSDNR_Retail"].~....D..\pQ...}..../....O.%.>.U.........a...%...f..(.~..{P...ertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.or.~...3.6pL..g....R4g,.D.(.u..S.......R*...@..Y..}.....Y...YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr....(.[z...C...F"k%.....P..\......

C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	27426
Entropy (8bit):	6.727485829099785
Encrypted:	false
SSDEEP:	768:zI6LerVX1tHC1eiCWWD0YNPnRvmJBKQy/4:zIHVX1uxCWWD0YNvRvAO4
MD5:	294C52AB16EE04FD5C99A39DC9B4E4F1
SHA1:	65E3450964742B03D0D4CA7C982864811BC06CF1
SHA-256:	4A68ECB341BD0D9DD0D45CD32747DFC21C288847DC3A440BEAF87AAD5C582AC0
SHA-512:	3D3B610819D1EE797ADCF6614A0C76E6DF7B395C24CA05322B9B2FDB159B6F428DBFEB185614EAD96F2E84607F87EF438756E6D325F4DA1EC0309E9507FA692D
Malicious:	false
Preview:	.......~1..>.....9...L...w.....{..G....$o._.....M.H..E0..:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c3100bea-7aff-7e1b-cccc-bdc275d83214}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xt.x......}&..:..V..g.......z.#.....{...7... `.B....C.W...H2...microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeC7D96193-844A-44BD-93D0-76E4B.Z#...5..X...>.._.+...K./.%...."........h.......G.....t..15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/Xk/Z...=..:v..2..E.y....O.9.;.Y...y..W...."..W....Og.?....../TM/v2" value="Office16StandardR_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www.mp.d.....k;.......Z....n..x.'.^...?.....R}0.B.....Q....[6..policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-442E-8202-(SP...3..1...i...-...A.$.'.^...:..

C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11923
Entropy (8bit):	6.966248462892631
Encrypted:	false
SSDEEP:	192:NYQRkb6nmtxBR/3urWhqueuYdm/KVbevkbPAhu+qiB:tRkumtfZqgAuwU6KkbPP+qU
MD5:	4E95316F0EB10155EC3A0A9AF84F7C6D
SHA1:	36CB22B4C6F538EF99F2A826BA7F37E270A9F1C6
SHA-256:	9D2F625ADFFAEBDFAEBBDE86B57B0911CBEAA5DC90FE8D0E0E2E1AA198EFF707
SHA-512:	6D49527CBED50F7E605AFA0C4B941A0669A09E9CDE65001A7CF46B24B3E61110ACE927D2D1687767C7841929C745B825CEC0078599AFE47B78DDA68A423CB1C2
Malicious:	false
Preview:	1.@x}..5h]..i..Z.`!...+}S.m&%..).....Y.ME..xO.x ..I?`}...r.7#trg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{93075f99-0fd5-441d-a803-.f." ...-z..."....?\|u.^s1E.gu&..lI.D..W.C......0. .#.W%.n.?.4< s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.R.k...'1l.Zv..Y.#5;.R"v..o)"..+B..t...V....wC.n+E.^8md.^.#.+j:itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16StandardR_Grace"]</r:anX.l.<2..fwW.K<..].>}..Jp/B.o 98.gS..S..\L...dO.?pY.4=}g.X.k..?=sessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000/.9.</..\|y..K<..&.4v..J;v..D /..~...`...a.T..~H.o.T.G49r.d.\|.5;rxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI44.+.6p.X}z.&3....7..d.tj.s`.@.o..K..

C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10955
Entropy (8bit):	7.162867008365721
Encrypted:	false
SSDEEP:	192:Q2A176JQHH8UL9ttJLUMNkr6pSXdL+s5Cuk7ipL5Kn5lSE/w:Q2A2JuH8a5VkeQXdKs5Caan5lt4
MD5:	5D5E0536ABFF2D682826BA038696ECFE
SHA1:	09CB103F557218739D859CB0C594A43E95DD0962
SHA-256:	5E82E5318EC3036ED160679A25E98D8FD23CF7F9C5E27E418184D18ADBC4F2EB
SHA-512:	194EBA162D76825D840642EC2AA4EA0210FEB7D5E2E14E1E5C208D56C72DE3A1E1D020A73E2153EFD601FE624CB17ED1B16CDB6C9342B79C7326511C85B60B04
Malicious:	false
Preview:	.../.:.....k..y..E..,...}...-..~..%..a.....T.../.oSZ8..\......rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{6caa3572-6692-498f-8f57-..7u.'.....{..6...X.&J..1...~..&..<.@>.....]..P..<F9{..6/.....s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.h.<.0...T.$..[D.hP..v.."..&.gMu,.........-.".dgMw.(....../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .[&]./.....w..x.Y..n...a...z..y..(%J5......T....EAqQ..........s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b.q`B.......N..f..)q.+[..G.........4.ha........V...m^L5.@.......PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4.[.#......^..L...a./c..B...0..0..`9U).

C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	27429
Entropy (8bit):	6.722378117144305
Encrypted:	false
SSDEEP:	384:Eows9UCA7MMrHUC0TbUNch6QR3pRENP+47KlZY8c50u+xUg41Uo6yk5watQuvJjA:6/IM63PR3P8x7OCUdBtplX6cDUQu
MD5:	0AD38F5E4589688794AEAF7F90AF3A32
SHA1:	E1E0DD895CFA324C317BD4954357CFB1D194A8B0
SHA-256:	12C8E2D2B499AD2BE609B04FFCEAE585329F598774B0D186BA23EA715C1F8974
SHA-512:	78DC8E0A5C1EBCB30C475FAA0653CA046C773DD8D504AED8FF989250F02A37E903154E481F9EBF4B4EE346085C3BAA37ECC32784D479C6EBDE6858B47D2F9CEF
Malicious:	false
Preview:	].(.....h.]..Kd.H..Rl...2Q....}..y......H.#.vq..c.....R...U....:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{4d653ef4-071a-3985-d812-22f3f1356957}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.D....j.J.AO{t....9...f....q..H....'J9.r~..*.....H...G.....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office4A31C291-3A12-4C64-B8AB-CD792.....3...\|.7Kht.M.@s...5F....z.l.....N.i.Vv.c.....X.......15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.e...;.>...GGox.W......1^....4.7......z.pa..d....Nx...0...[/TM/v2" value="Office16StandardR_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www..A.....<.[...OC8........~....\|..7.......'./".c.....S.......:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-442E-8202.....@.}...K.5 I...f.@.5Q...\|..7....

C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11908
Entropy (8bit):	7.10793814879401
Encrypted:	false
SSDEEP:	192:vJO2KtLDoT/Bb6EIeV0MVlYDTaIYjCfttKgR2Xnk6a:vQ2Kt4VWDe/VamIYkmgsXn2
MD5:	C9EB55458182D9894DA274AC36A5F44F
SHA1:	1B246826026BC52B8B7AC75A949A0A586FE898FE
SHA-256:	BD8B7E6189A8754ADA1A36788BE3FBF890DA86E03A9A30BE5804F8FB0E06A238
SHA-512:	EACDD61B6718E9C71C67FCFE8F1DBD90CA2F8CBEFA8DBEB73386A0941BD1607868A368C20410F14FCD5DDC57D54AA74CA10214D8A60DD6CEF7F8E790F53A9DAC
Malicious:	false
Preview:	.k...C.(........0.R.L._.$.^0.....`.....wC......N1,.....@>rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{938f3176-8d03-4548-a3aa-i.X...M.0...^....:....Z.U.'..u...L.p...V.~.Q...c#yi....._js:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..%...c/:........t.....].#..2.W.\|.bY[GF.$L.......C(5.....pitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16StandardR_Retail"]</r:an......\.{...B.....r........%."~.A.H..WY@[.,_.....<JQ63....ckssessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000q.Q...B.{....B.....y...J...%..~...E.+.C}...`....../9Xr&....._odrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI4j.C....G.../.....8.1.H...e.Zk...~.*Y

C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20252
Entropy (8bit):	7.184328297865302
Encrypted:	false
SSDEEP:	384:8iSfaSVpZyHu1/H1O2Wy9d51t4I7EAajuKwZrF56b:K5VHEGO2Wy9d51t4kE/2s
MD5:	CF10444238F971190E1EE33ADAE635BA
SHA1:	37CBD3A8900A563D3FFD1E13EA2B394BFFC8F19C
SHA-256:	01D847E038FEDC772192822BA778E72E7C0F2CB1D917B105553E798BD29A9249
SHA-512:	CAC56432219658ABF63399A6B34878AE63405910E62D877D781946AC647EDF0E3D9E999E138FE2BB6419AEBA876A4D4FD5EEBB5531F51BB4A001039ACF3DDC36
Malicious:	false
Preview:	..1`J....2.....!.^'iw.o..5.&=..A.......1.C...oXa...R..+j}rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{9d2811e8-b69c-44df-887f-.s.>D....q....Q...\|...1;.r.M6.~x..WZ.......g......yVv...P.(u)s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/i..s-....k....C....5..s`\|.O..2.~?..j..D.....C.....^...C..y65:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16StandardR_Retail"]</r:L/.1.....!.......5..uMu.>..a.tm..K.._F.....P......\|a..E..7m>Possessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/20.q.lL.. ...S....N..~Zx.u.Ig t{..RL.Ru...>.o..f.o...PD..z.lkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOdu.e^....#...<...B./?TZ.P.-h.4I..CE.i^

C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11467
Entropy (8bit):	7.07521467992164
Encrypted:	false
SSDEEP:	192:H3oBjb0EFSI2D65XUIk7sdBmM5oqwbmcwZRBQKnG:H3mjbWOSI9BJyboHlG
MD5:	C12F4DC7BD5C419B5B2C200E56D96A46
SHA1:	03192F86E98F7136C93B3CED3D695341B7B5D200
SHA-256:	6AF557771145D09087CE53C126FD8027487E45A7274C3779A62BE81117024851
SHA-512:	30E9F739CBCBE55718809102E986DB188E564F2EB2BB3F95F7D7024EB887EC73316E278F57D56C01056BEC813029A4A758D4BB06D9A7DC6FF0205CEEE3BF9976
Malicious:	false
Preview:	.epf..h.p1.;l+.^e?...p.u..Q.d..%f.Fg...T$..D.....t..G.$.{0.s.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{284d73cd-2cd6-452b-ada0-..i..=.6rB~b`.H5q...(.9..[.g..`).P/.....s.....5......WC6$.l.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/...u..H.bh".04..f!....$.~C)S.c..'"......N........@....q.z5.)./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ......`.r%.'{+.Wz#...6.i<.Y.6..a\|.a&.....h"........q..W.B.y=.i.gPeriod"></r:forAll><r:forAll varName="licenseProperties"></r:forAll><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/200...c..h.44..<`...N.....w....G..r..St......t..;.[..^.u.Z+.B.rlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5bfK4QfS8h050WPtpN/NGL7batTKnEjNnRNrenM8+YAT9Ne7K7xCwgJdb08rOZyMqQPKtPr1p6FCwPY7zBvOmtNdvV..)..@.!u2$Y8.W`6....\|./..a#.0C.Y+...

C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	27478
Entropy (8bit):	6.698171172789382
Encrypted:	false
SSDEEP:	384:WEvIHnsR6If10pVTVxAKG84LqcHBRPCtCNC7LcDePcVlyjKReBo7fUS1OKyPqsam:lIHOiRCPtmS+AReCfRpwacd
MD5:	F61FD2A63257CC38ED9C73F0C822F598
SHA1:	F740337DFA928E91B2B33302E343C46A1A591C67
SHA-256:	18C40CFC9D8ECEE076E3CB1F80A9ADBAC96B315E44EBDAF544D548B0AC6F1A6C
SHA-512:	367C857AA83F088456DE01D22C831F0671AE4E3D499A616894C861A7904E6A58A780AA0759D11B66C3116DD0BD4D51273892CB26EF8A1A38893C22CA53B869AF
Malicious:	false
Preview:	.@.A&......I...t0Z...?..uo5.S....D.,.p..#........%!.;a..P.0B.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{634035b8-37b0-6f1f-0514-ed1ffbff972c}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x!.O.#..........(....-..$0a.....$u-,....s........`n*!f.B.2G..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office6CE96173-4198-49FC-9924-CC8EE..`J+....v...'a...%..bl4......Q.u.n...0........:9+1,..CtS.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X>.mO6...........={....?..zn"......N..%...8.......2!m.@.5W.\|./TM/v2" value="Office16StandardR_Trial"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www.m%.S.j.........:.fJ....0..9vc.....L@.h. ...o......./%-'{..S.6\.policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-442E-8202-}.gH ........Y.fa...s..oI?.....L@.m.1.

C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11920
Entropy (8bit):	7.066328068217435
Encrypted:	false
SSDEEP:	192:hX6xtq4L+DkUDqcjPkZJ7SdpnLScFoMN1oTWYDPQVWh:hX6DniK1SrmOrItbQw
MD5:	FCFB145001FBD202C91500E1E42948F7
SHA1:	044104C31BDD0B16F4013EC397B15C1F36266EB3
SHA-256:	21E4FDCE77D28D0F27A5120CAB973BF72391E49C31750B423BD3D2A1611380A0
SHA-512:	4B44245859CAA18CAD770E0F877D5124BB0E0DD1C73A42DD70A31062F5276AFADEC17805F79253A65AE4DDEE6B8E7D5F3DD3CEC9CCED0D4A46198C2230DF4971
Malicious:	false
Preview:	@R...h..n........M.sw..pwS".T YD9..B5...=.y..8]5R..].ER.....5.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{5954f83b-5144-4a9d-a2db-.....$..}.....0.....}..(;E?..#N.\|..T}...9.;(.n.g....\|..la...s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.}..b..\|...F."O.S.g3..y\|...['].;.W.M...l.+T.7Q8D...Z.\KQ...\|.itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16StandardR_Trial"]</r:anX.u..b..=...W.?..../...+%Bw.R<..w..Ej.f.)y.$]2..._._RW...).sessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000/.....\|..'...W.B>.$.$...`\|.q.RK.n._HY...[.hO.>ZgE....V.J.k...-.rxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI44..r.A......:.V(.-.e...E~j~........sr..

C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9389
Entropy (8bit):	7.101501748515721
Encrypted:	false
SSDEEP:	96:Qe3m3eMpQLs0COyjNzhrm4QaR3Q2FON3o3S10iKZirE+8d2j5zuyVdX4nxYUXeZV:O3pas0HMjcalbOw+Wkj5tiYee+OuBT+
MD5:	1FCE13FE38AD866237A0A7A6A9777658
SHA1:	1895E4D22A72F26CBC8F3DE8D6043C5F14289AE0
SHA-256:	6B7304696A1C180B1A11DF5429EEB39631D393EC7766676151E08E30E75965F6
SHA-512:	5E8AC49EBDCDAA089C127500A48757EE4286DE1A20A8F70174ACA54BCC0ADFB00F09D8BE613FC5CD849E8B1DB887A0E8B8BE42B4DB270ACF34C5CF2D9BDB6BBD
Malicious:	false
Preview:	..!.&.]...`......q.2b."...r.2.j.O.K@..T.n&.>v...{......F:....r:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{793a0260-2e20-e314-b1c3-730481a11b88}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xT..#.H...\|.....-.g'.v..@(Re.e.~8K5..$r><.:y..m.@....r....k.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeDEDFA23D-6ED1-45A6-85DC-63CAE....]8....2.....@%.-2.3...%T'./.Z..F...}l..q...r......x.Z.y15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/XK...6)}...,....Z/.K$.?...&J=.<..[I...DLu..8f...0......1g.&;./TM/v2" value="Office16StandardVL_KMS_Client"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:/...7.Y....}.....^o.P.....B4;..>..JZ....Sus.>a......M...:...hy><sl:policyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-442E....+P....$...X..b.3\|.4....w.6...OJZ...

C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11943
Entropy (8bit):	7.06942995932213
Encrypted:	false
SSDEEP:	192:kDhLdQqKyBStGgEhx2A1n2gqtiPOaQ7ommUfK:kdLdQbyM0gUxV12goyc71Ri
MD5:	2B4F3BC016A1CD6965CB3F26A9EFE531
SHA1:	13039BF2115CFF6D4185AFAF93053BB06DE56A3A
SHA-256:	EA373167CAD8E0672C44FE0A27836CF12A45190C808E473201D4DF838970D37C
SHA-512:	5673CE6DDB943E9E93A5192ABEA8AFEA0E62662C86C7D141C3483B1A6818C86E1EFED16514BFA858991C061E19A2B60ACF51AF6D5FE354AE8A6D144D2E27BE62
Malicious:	false
Preview:	..Pm..?.k;.............. Y.vtT.;...Q..DfHc...].1..N\=...M<.urg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{f4791335-5d7e-44f7-a7a9-[..d..0.y.^...@d....'J.=S.uc..t......@h.4.......%$}.P...(.5!s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/,.~....yb. ....4.....v.].[.qp....\.%...8.H..P.:.AY[0......c;itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16StandardVL_KMS_Client"]<G..0..?..5......Bf...\|...Q.&/..(.......;HJ....>..`JpC..P".)rtyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.orgG..a..b.d5...........Q...\.mvW........D6{m...V....g. 3...Yf.m.BcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrW2....k..?.<...oE.....X;[.~.Ht3.4....

C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9932
Entropy (8bit):	7.087784804124681
Encrypted:	false
SSDEEP:	96:imOu0fFqogRA7bxrRom0ETpffgmxvawRILOBsWna8Q8jfEj7ZgWaZwkH4zpqVAc7:m9gcxFogTmmLFXnaaIVU3lZrGqqhjXxG
MD5:	B2B3BF643748E8D6B8E74704EC2EA13C
SHA1:	689294D2936BE1CB58BAD9B806247AF1F5BAE634
SHA-256:	30B13CAA1AAEE63BEC4C6A87862CF53A2AFAABD551346B2E7A39563C7E98BF8A
SHA-512:	BCC5027541A1CE3026082025AE4C2C3A4BD4B3E7C4960E9CCD6F1BADE9DE87EC09D59C983B66380D792528AFFECBE9F8662A96AD6926324BF4D76BCF7D532F56
Malicious:	false
Preview:	_ft..".B.}.d.[......<i....fC..v.z3..W..j...VO..b.r..E.pf...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{6f85be4a-cc6f-4149-8bc3-.....l...;../.MT....d1....5@..9.l{..Y..(.......2K..E..6.=r..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..f(.b.$..{.......h`.T..iD..2.<K....Mm...\I..t..5....ti...r:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16StandardVL_KMS_Client....L`.@jf.}.PJ..... #.P..}l...?.&x.O).M8....TG.J%.m..G.!x..opertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.....j...;..`.QJ.... ^.+..v{..f. S.Y..Tk.....]..d.w...,k...z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlEx.bm....2...?.Rv..../J.'..7u..d./d.kQ

C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10947
Entropy (8bit):	7.057990316246843
Encrypted:	false
SSDEEP:	192:VGc0UGEEUVA844dPMRk7bUIJ1BPJfw8semoV1+bDX3:VAZXw42Pbf1BBfw8seJV1gD
MD5:	CCA636A74B98BF0DD0A02D2596D96102
SHA1:	E9B1CB28EFCDB7F66029A07E990FD3525314F1EF
SHA-256:	14540F6BB8D44888EF838D632A06BC4C5A5C83C87EC50FC89A2848D619531EC7
SHA-512:	FA033BDE9289D602C1078F20B2B446962272F514A2C878B964ACBBEFA656D13A840CC19058A586ADBF5561A844B45E19FDC58A606EF17D54EE5111D836056D52
Malicious:	false
Preview:	..">V.-....]2y.....=.I...:...j.5..S?.P..F.9..)...X.p.[.?i!.).rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{d75bbcf2-b80e-40c6-a5f7-. .\|cK. ...Sy6..^.7.....'..2..,.../.T.E..oY.a../2.G.ewe$5.6.s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/}AW1Y\*......-$..B.y.........2..w[.....P.HE2I.%...l.?.{Q%h$.s./r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll OrhP`C.\|....J2x...........9...m..83..y...IS.<..#..(z.I.GQ"$5.6.s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b_X.Og}_)...~/f...w.:.....;.....$..S6./wLoNb".4...U.}..V.^4.+.PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4srX.jd.%j...LkL..g.>.Q...3....$.p/....

C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	9324
Entropy (8bit):	7.113820086058987
Encrypted:	false
SSDEEP:	192:o67aApdGKas+obtsgLbZ5b2kf5VoIymGF7R1GqFZ:o6mApdGls+obts4ZdZDphK7Hpj
MD5:	818EA06CF4DDA0D5A6EE7201F59C1E02
SHA1:	5FB69C6CA6499EE34E74B418DE39F6DA1292EABF
SHA-256:	0E04DE402376A103F60B189596705C47905142052A0B360A8D8D2AC8E95F4EE4
SHA-512:	683D1441E9A4895C4CF4ED70C1AB9D5B9DFE573438DFC2BE579A0BB98DED5177690419854B7A05E10F0DE65D76CC02640D633329AEAE358ADE7D016A375A2625
Malicious:	false
Preview:	....;..T..^D....8UO..a.J....US\.t..=..`.ndO....z......P:.-X:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{5c15092f-507c-4488-0b97-92b9e8907d81}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x=...>....C..Z[...f....5..B..NY\{3^.lG.z.VtpK....l..G.....B7.(A.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office0ED94AAC-2234-4309-BA29-74BDB....4...u..^H....*J...f.I....R.[.\|..#.Xf.$xo..D.s.......~.<S15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X"...+......RO....x,...b.K......YL=.Vh..1.7zI....1........5j.../TM/v2" value="Office16StandardVL_MAK"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://www.mi3...k....\..ef\...ZWBs. ..P....KY.{.Sv.MbFd8.P...o......Qk.eFolicyInt name="office-C845E028-E091-442E-8202-21F596C559A0">1</sl:policyInt><sl:policyInt name="office-C845E028-E091-442E-8202-1a...2.........\..f..I.v.K.....KY.~.Bf.

C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11910
Entropy (8bit):	7.093675360708808
Encrypted:	false
SSDEEP:	192:7mcoi3RZeXNbeI7N05BNnL89xuUWGc7ZaV/KbsHFCQgOp:7mDiBZVI7gznkbWOCbsHFX
MD5:	3E5EA6AE7F1C55CA9AA81C6B0F1A08F2
SHA1:	4D1CFFFA6BDDD50E5A225A9F861FAEE82010831A
SHA-256:	8DB2C85658C31A82062FA7BBDF960F4A7449EF841CB907F81D3679212189DE98
SHA-512:	B83541E2758733330CEFC577129D182C9619D468FF3A5CC312387FA45B19427CA6E34E486C05A61ECDC82C06F2DA9E8A3493247637E40E738954408B86C5F788
Malicious:	false
Preview:	.._......0..E.."..M.&.0{...l......>.......!ce...'.E..B.....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{b3709e57-c3ad-48a1-868f-.M:.#...M.q....l."G..~.&f...{.....Z..........s+Y.......[...Cs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/"+NLI...[*.....<.k.../.m[...h.....j.<X..E..,un.. .\..GX..Yitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16StandardVL_MAK"]</r:anXm.<{.c......\|..X..o.......ir...g.....q.qR...\.`87...'.@..N.'..^essor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000/0_V{.}....W\\|.y..e.....&.oY...g.....V.ko...F..0H:...c....Y"..._xP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI449M;qQ@...63..o..S..>..$.`n..r...W.lu

C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20254
Entropy (8bit):	7.222560861313052
Encrypted:	false
SSDEEP:	384:cP4RVOGRSquOGlJdwN4qYDHTFjJ8AE5D1X079:9pRj4D0iDHTFjWAE5i
MD5:	FD8D5777D12EBBD61FB51BE49A4B896C
SHA1:	07B51CC86E2D59045F643C61D7A38525BAB49759
SHA-256:	320FAB5A7C014838D60997CC8FCBDD8DBEB509099BB3DA3A54C714477836DECE
SHA-512:	748645B3C40CBB943D2CE1E9911C3BC839C4EE20A9A8ED27BDCE3625E4449D4437AA913E2A8FFC66A64D074957F1E165CA2DA66AD42EAEFCF9582B90EADAF979
Malicious:	false
Preview:	.J...%3)O....O.......K..}.%.kx...'.KW.M....I.0`..A..S.d.F....rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{163e2dcc-498f-4e1e-868e-.....ihu............X...`.v.\| .N.1..G.I......Fx\.+.'........Js:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/g."./..]...........TB.Q]..o .E.a.?U..B..I.0`..&./S.(.HM..V:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office16StandardVL_MAK"]</r:an{....-, .............LB.S`..~....7..;..H...P.1,..t..T.4.Y...Kssessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2000..V.02!...........AB..,...h0.....2...u...J.d\|..g....p.i...OdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSOI4..D..o." ...........cl..H.6.Z\|...5....

C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25923
Entropy (8bit):	6.629039413125589
Encrypted:	false
SSDEEP:	384:jKjZGj+tPFMJwmDYVDNy7P/cET/nPc61uyaDgOeiCBn8rfy0P8H7iKFVXPqbMPK:6ZGmOJRYV5yYqHrbnpzH7R5K
MD5:	ECF0D899CE7E9FE4C9603FCE89148A7A
SHA1:	16E79F0D4B173E34FB69A6BA2A1796892C8FE43E
SHA-256:	0B275D7DB58C8ED8AB8FD629FD355FE3194EB934FB9209D51FE39EB2D27F6266
SHA-512:	BE5736552A0939E60A363D075ABCFCD449D9731AA0C25D0A5FEC72DC2ED554CCE885935810D5FCAF2A97ED98BE73E538389999BCA7BD25D8DED81F0D02B3D94B
Malicious:	false
Preview:	.....W7.z/1....X.@Vt....e.a....$o....\.9..3]..v.1....2..;.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{ad345361-6cc0-f3c2-aa0d-7ed559e99331}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.....Bf.y8-N.....I..f].._.?.6.....o}.....-..8@..:.~...Wz8..>..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeC726993A-CD6C-499F-B672-F36AE.......{.\.c8......._.n....2.t....,6.....O.%..h...l.)...\pq...15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.....wt.>h}H......W9.t....1.n...mmG....G.'..9U.]5.1D?.joO...E/TM/v2" value="Office19VisioPro2019DemoR_BypassTrial180"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns.....N/.6el.......K..;.....a.B...0.\|......g.Kj@.I&.5...S9).yK/sl:priority><sl:policyInt name="office-A4C55BC1-B94C-4058-B15C-B9D4AE540AD1">1</sl:policyInt><sl:policyInt name="office-A4C55BC.....o.9rn6....P}D5.Y....=.8.....x@..

C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11986
Entropy (8bit):	7.096646274312987
Encrypted:	false
SSDEEP:	192:fZbV5gkJNHjCwaFv1QS89TXZu/SyMw5kg9dN02sXKv:fZJacjBU9QhTX0/zMw5FNH
MD5:	A4740CD3F524DBF87E2A89D3B73CC29C
SHA1:	D5016FF368F427669BA2B8147E848E8481DDB3CB
SHA-256:	CDD4356E2F89418FE38105C417E455658353EC3596AC1984364EFBDD14AEE25E
SHA-512:	3CA6BF8F98BFFD387D54B19A01227B1C5005834ABE0F7601DBB7BF128694765B57AE1F7DD801841787597E6D29C49C666EC6526216FB1762B5C56A671E703DCF
Malicious:	false
Preview:	+6..q..Z.......K..*cM.$...'B.....;..M......t....Y&.......BK..x.rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{762d4fb1-0230-4510-8256-..e.y.....L..e.]/.u>GX\|..:H_...t...J.....#.].X...7..2.......g[s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.......z../$.1..\|.iw.Bp..B.@.......P5a...._....O-.S..........1Aitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19VisioPro2019DemoR_Bypass..=.".....GF.}.K..w..[v...!I....t...lZ....)...(P$....$.......{\d"><r:propertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http:/..#.`......F.w..m."b.Fh.../.G........{W.../....P=.E......RE..a[1rN1aIy6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0..'....N.,3....v.0...U..1+d(.....#Xuu.

C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10987
Entropy (8bit):	7.060775301665945
Encrypted:	false
SSDEEP:	192:iwyPxOL0i9tonahx833MBsuxFBx74GjDaI1DlXJ:ifJDisnMx83cB5Bp3j22
MD5:	DC00E4FB8E0C8AB69F78D73FA39833BE
SHA1:	AD9AA0C716051CCE0D21BDFAB08BE7A0F67C4F5F
SHA-256:	D2DBC87D6A8E167739AEEA08754819FB7408925318CCAF295DA275E9BC73103A
SHA-512:	95C7E04B62381C6455C6914E13073DB0D9ABFF70E3F4D117022D40C743C007299E0EBD88F3CA350B63F18FD55E736429074CA56ED4F04D98E7F044877F1B8AA7
Malicious:	false
Preview:	31....,Q!W[Z6.....!%..W.hh.Q.xVm.N..\..5.e/.P.W.. ..`z..xS0...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{7c7d244b-48d0-4dc1-8ecc-.tJ..%^5G.J8....~x....$~.[@{A5.......;.km.YT.O.....AM.-..}..Rs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/....~..q3.jej.....b1....c5.S..R5...H!.Qf.5....2.-..w5.3-I1.../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll ..4bG.$.#CWF!.....,$....tJ.YDCj.^. ..Wo.ga.P.P..p..kC..-N}..Rs="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b..r}@.yU1.......WG....R@.p.X_..I..<..S..d..YuI.....vw.[*d...mPKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4....M.'YW.Qo'....G$..O.W]...W.#.q.<...%

C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	DOS executable (COM, 0x8C-variant)
Category:	dropped
Size (bytes):	26004
Entropy (8bit):	6.564625288891672
Encrypted:	false
SSDEEP:	384:PEjs2nEYp4ShwYXywqkYMPWGbHjx7XB3i+eeIgFdXbCxu69yfhpWbihfPMLBeQGZ:PJcEr4iljcH1TBjX2/U+rLgt5pIa
MD5:	7F36E8870F5E1C01EBEFE0CB426DE7FE
SHA1:	5ACAF408C3C21483BB1878551FE815DC525F2D7D
SHA-256:	CBCBA7FA0923F05B4435180A6CED19A9090682A95F90C8647F218C5603344980
SHA-512:	86EFB3A09A7B63ED39212F9A792546B325C418A08C77F09E33C9B5D9E3B6C8F36A1B4D3CF69BB6FF0BB3155CDE5A2B7CB411F40E5C41E98F96DC3DB313EA95D4
Malicious:	false
Preview:	..e.i....;.L.:...eH=.%.I$..?np.6....T.}.9.f.c./O...5n=../pvJ3>:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{687710a3-e0b9-3bdd-6602-b65bd7a4a22e}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x...l?.Y..,...%...9.h.7...{.\k9\|..........i.r.l.2...zj'.Cgb{H6'.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office0758C976-EA87-4128-8C1C-F7AF1!..`..D....s.6..1Z".?.^'.Qm{w.1..P.J./.Gz.d.}O...-k7.Hm+2."515-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X....y..K.\|...1..;.D.%.F%.Rsa9.3......m."Tx.s.'H...5-..~r.&r.b/TM/v2" value="Office19VisioPro2019MSDNR_Retail"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="htt....!%.J..=.P.:...7.`.A....".;b......H.0.qGx.o.(H...h2o.@1w$M(?rity><sl:policyInt name="office-A4C55BC1-B94C-4058-B15C-B9D4AE540AD1">1</sl:policyInt><sl:policyInt name="office-A4C55BC1-B94C-4S....c.'..g......."<.;...8.U!f!. ..J.H.

C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11941
Entropy (8bit):	7.099333352325699
Encrypted:	false
SSDEEP:	192:FqSKawCxnrqIswr1S7wih9CbNwriFijk+N6/9fIymKN:FpKa3rBswr1S7vh9uwric1wZIy7N
MD5:	FE5787DA347A9BEE7F78E925013DE6B3
SHA1:	CAC56A7837459CD42B19E7AEC1F53214901700BF
SHA-256:	2E4F2CB0A2BD4119BD549E76837CFC7F97F6E85022FB254E82E6A836BD291DF8
SHA-512:	B7544A85AF3811FABB9B14D879EC6F7213B15556F4388BF9FBD9ED8347E231DE715FF8A879B8DCFB9D4D8095B17A7EB160FCC99A055C628DF1FB8BAAC1385134
Malicious:	false
Preview:	..#s...mT...._<......."C......-.....HA.'.......8s..oQ.,..g..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{a908925c-6f5a-4c22-aab4-.s.{...b@......]...HzfU7......b.D...LO.p....U.....7ojv..d.Ss:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.C.`..MF......p.....D+!........i..t..............ud..vHZ}..{.Iitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19VisioPro2019MSDNR_Retail.L.`...o,....B7.B.....h6.#../...d..G.U....6.......U..sE.j..3.OopertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3..c.`...1[....\6.X......a...8...=..l.C....~.....$.>c..t.K...@..z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlEx.c....5@....a5.\|.......m...6...?..[.q.

C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20285
Entropy (8bit):	7.185777169573546
Encrypted:	false
SSDEEP:	384:c1+dBJwSwQyWeIsAtBCd2qvsW66lRm7POoNEyikHo+f:c8miyWb8vLVDwOoqp0f
MD5:	74D23629CFB82743D7FF344B5C080400
SHA1:	1A89D0B10431758081667287987CECBCB7E87D88
SHA-256:	BC827B8E3393CFD3C486D5430766E18CC1D099373175F317A697DFA416F7B905
SHA-512:	5FAF9DFD24A726BB43F2240FC23754EFDF2AD03CF42EB136D5E20E56AA06960A674BA54F55221B913098CFA98BD73F4B1327FC8FDFCD80D3C7432504D9846702
Malicious:	false
Preview:	i.9.\......r.s...GaO)(D.c....k.y..G.....q....<.b.e~...G...I...Erg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c6ba0076-d213-4895-aff3-.C..ZK]...4.8.....<Exp..u....\|N<..Q........e..SW..2.A.......s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.!..;.!2...MCl.....u.b\|M.>....oN{......."....<.b.e~.:Gm.G._..:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19VisioPro2019MSDNR_Reta...._R.DS..m._.....<.df../....~j7............4.I.{~...B...._.EpropertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w.]..R^N..0U5.....&.(..R....u}:..D...8..Z.9.n.aC..=}e..V.R.6y6z4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRl...4'?1{.9GX...9..IEr.F....4s...F....

C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25932
Entropy (8bit):	6.714114885478385
Encrypted:	false
SSDEEP:	384:CPrv9lWfV+qsX9DYKAVz9JCNmp/wBSeSPcLoApbJUTlOmsd8oC6EFifOQ8b:CZlWfVUXiN19JSmGBSehPUYmsiVmtm
MD5:	A215FAA32C8646CD2953F4595D641028
SHA1:	8FEDE21B908079DE77DAF865E474B8E4609C8361
SHA-256:	B3A349D6EAEFE82E2986459D76684746FA59EC491020B46E0EC9DC9C276CB361
SHA-512:	D0E5DA786BA7DA1A6DAAA5DB420959123684236004CCDC3E9415A7DA8A32978C0E3B73CBEB67A5E9534A8155839A98DD25590BE4DC0E6CFFC01CE08C4906745D
Malicious:	false
Preview:	F.....V..G<.?..\|.\|.3T.#EE`...B...k..`nB(.........@.......6.:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{31bb0944-ca8e-8f73-fc2c-36fcf6b51786}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x.G.R.....[u. ..d..).!..r..:..M4.k..r.-x.......D.......3..microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>OfficeDB2760F6-F36B-403C-A0E7-0B59C.n....&.......3..-..c.)E.4FD7......2..,<D;..........E.J....F'.15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.f...)....s.4..7....3I.,DR4......i..(~.3...........&...:../TM/v2" value="Office19VisioPro2019R_Grace"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http://w.\.L...U...Aa.?.....c.a\|.r.rE...BX....-9.(.................=.<sl:policyInt name="office-A4C55BC1-B94C-4058-B15C-B9D4AE540AD1">1</sl:policyInt><sl:policyInt name="office-A4C55BC1-B94C-4058-B...... ..........`.c..../FHj...X....0

C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11940
Entropy (8bit):	7.023819466375155
Encrypted:	false
SSDEEP:	192:s/msNfR9U/WxilOij9HtbE8KI9s9z4GT1iBrDEmmp8:s/mSfR9T6/j928PsvarDVma
MD5:	49D5FB634C3711EB90C3FFD49A5A87E1
SHA1:	B87C1B658E073DDF6753E67ECF4CC7005E3DC460
SHA-256:	D94F222034EBC8954C940A9F20783C22DFDE8FA07726B3DF0996BCAE01324F3C
SHA-512:	5F9DDC924F951EDF2299E6B665CF66DCC6FD76D5F96F3A333870199609DBC84D1E796480A528FA400CBC75B9BB7F3710A86B1EE501A6677AACFB4E81C1F23CC6
Malicious:	false
Preview:	..v......R!.w\.25L.oV.T....3T..P...!6+.S.(].R...W...j.@A.C.W/.6rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{5db64419-a26e-4309-95cf-.M..VV.....1.<..b{..e...3...`W.....ii;.W.j.....Vk..pK...v..C,.bs:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/r'..h.....c..h..1+..+..]t@8.<S..R..YB)...zv.]...\..m.YXF...3.xitle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19VisioPro2019R_Grace"]</r....].....R .w\.1+R.e..CP...fHZ.....`.....;W....I...&.G.UI.K$.xyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.org/2.E...]....S .y..1+/..?.HG...?.\.....y}7.,.lM.V..4S../V.Tx\.....oYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUrWZSy<...O...P..}q.\$;..6..I=5.=`S.]...ht}.

C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	10979
Entropy (8bit):	7.189897152100934
Encrypted:	false
SSDEEP:	192:+v6+njtiVszDxMUp02Ptmb6IQlfVj1u9RssjUG9sFRVb59x8:+hysfU2PYb6IMVpOVdsFlk
MD5:	D67EE15F75638313F4BF7E5D5EE5F45E
SHA1:	9952BB217BD122C7CC0C5F89603178A7E6F14533
SHA-256:	86AA089940DA7C9E53ED604E7BA73349F2A7C3403BF44AECBD8BE4814EE1956E
SHA-512:	8E4FEB498A5B98D2BBCBD33793F161FA3A5D97713743B94C60A98486DED8DAB2D2A5846CC3AE100F999E049607397EB6836BB154995DB8AF66AB6E0D530F3940
Malicious:	false
Preview:	Z.c.....0..g..H.*.z..b.....2UO.9..h..........6.}.j]....W...rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{09b56dbf-6fc3-4214-988b-.I.......s.N(....w.+._......j.../..x...........T.KjB<..C..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.x..........:..V.>]1..i.....jW.....(..@..[...;.v.}.G"..R../r:title><r:grant><r:forAll varName="productId"><r:anXmlExpression>/sl:productId/sl:pid</r:anXmlExpression></r:forAll><r:forAll .K.}.....,..f..T.+[b..~......5._..............f.S.ad.....C..s="http://www.w3.org/2000/09/xmldsig#"><RSAKeyValue><Modulus>uzDfZ3WsHY4/UKthrglDqsLw4BqrlOWlNdLBnLD/5sdAUXnv+2kB9jJJPK2TYkbkQ5b.a.b..........x..$.H.:..X..&...]9H.1..a..g.P.......\|P_J..B...PKtPr1p6FCwPY7zBvOmtNdvVs0psxwEuq2DmFz1g8+WJw9zGgqI4qkYA7P/yaN0lbQpvH3p1v68DogX7BLd6Z+Z+3MNG1Lh+k11kmd+lM8RaLq74zT8OSZDJ9McD9i/4.K..........\R...+....]..T...\|Dp....y.

C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	25937
Entropy (8bit):	6.69000304169508
Encrypted:	false
SSDEEP:	384:MeBsCZlQangfZfl/it9B/CNgW+nBS9xKBPc7JKA3M4JkHf7XAa4ixs4jHSVE/03Y:dhlQaCqrB/SgzS9MsMSkHzXzlxRjs2PR
MD5:	212932DFF4387C5BCA64CCB2DBC4C702
SHA1:	D0C65EAFBB0FB7D84D54B57BB0E6DAFFA5DEBE80
SHA-256:	8E91C6CB401033E2EC492C932D1540C18BEA45DFDFDE8A612EA53CBB8E27FC7E
SHA-512:	7EE28D4FA76044D49FB1201CC8B21FCEABF386F7262913E7C5934CC30BFB2E50F1AB1C805E18F202D77F964EA24E266C53AF97ECAAB83FC9DE4D299F4F2C7FE8
Malicious:	false
Preview:	......R.~._T..T'...SD.iH..~{i..1...A..ExH.9..Trf.f...L..5....:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{c5026242-f97f-deb1-d7f5-10a774300956}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" x../...G.\|.HH.K,^.....{....!=.>...4..5...-.._o/.....K.^'.....microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office4EF70E76-5115-4BD2-9B12-3B0CBH^p.c.....~...X,W..A[.sY....,;..t....G...~[R%... f.\|.....Tn...15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/X.$....r.(...._ M...=.iU..i/%..g......U)SA'..^za.%...m.KP..../TM/v2" value="Office19VisioPro2019R_OEM_Perp"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="http:QF6.P.R.=.UU..OgZ..R0......V (..<..E.A4HK:..Ee+.v...S..z..ty><sl:policyInt name="office-A4C55BC1-B94C-4058-B15C-B9D4AE540AD1">1</sl:policyInt><sl:policyInt name="office-A4C55BC1-B94C-405FD......g..g...yx.._J.u....j}k..j...E.

C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	11933
Entropy (8bit):	7.015050858753609
Encrypted:	false
SSDEEP:	192:t3ylsLbqtIY6SM6ypdjezkB245X0PlU/uinCI6:xyezYhypkzLSCHinCI6
MD5:	DF3B6F394D51CB197235345CD8B86105
SHA1:	8ED70A1ED793523FDDDBBE6F9324B6F25E14D6EC
SHA-256:	2D72868A52359C16616601E5F61CD496295D30BF08222210187AEB91E2DA00D8
SHA-512:	44347792CABBFB6F07EE588A8D1E0DA0DF43987BC5F7328E833A65C0A74D956A91EFD10D47F3CBD06C94483520ADF8C45B306A2FF6430F573D0EE49EE5074177
Malicious:	false
Preview:	...9..H]...t.2B..'... q....e...p2P.Z3_.y.[-G>..'$M....I<WO..rg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{5f49c09c-d860-4859-a23a-...5AOGSF.G3..}T..x...x)....6....?+F.uJ=[.;.R{.l...'.....qCL..s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/..7\|.h}.."K..o...d..tx...j...4...^Xc.M+.."K3..tiZ...<.m.S..itle><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19VisioPro2019R_OEM_Perp"]..?E.}\O..v.._..x...r....%`....? Y.S.`AYj./ C8..51z....cCkKS.ertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3.or..H5.J.....k..E.4...SU...2m...9.Y.g.y..g..wY.....`....nP.B...YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlExUr..)JmN.....4...a..[...EY..<O....6<..+.h

C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-phn.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	20277
Entropy (8bit):	7.176044460764244
Encrypted:	false
SSDEEP:	384:NhGa6n+F4jyyCVWzlSOZlcZP33gsJP9vdcs:w2yIEwZP3gU3v
MD5:	E7E2913429793FCD8D853EB1DD322F80
SHA1:	05B40BE74694BE14FB84044EA0FC5B78981C4ADD
SHA-256:	366C7317AFB574F762EF89A75137CFA1AE05882DD4245BCC1490887F13298BD6
SHA-512:	9BB2E8A6E4F121B06A3B42853A72D81D953723EF9126A85134192D0203957A2947FAF1AAD953429F6F8C190E1F880C9BF139048EE18CCC7FD55E783260C8A160
Malicious:	false
Preview:	&..Vu..J.........xV.g...H.....c".n.S.Qy'iVH.ky3.b.:._J._..Tfrg="urn:mpeg:mpeg21:2003:01-REL-R-NS"><r:license xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{1b27b3cf-faa2-40a9-8e9f-.j.[x.....d.....'..6Y.^....;g.w...Aw#g.}A.2+{.K...Ja9...\|K2s:mx="urn:mpeg:mpeg21:2003:01-REL-MX-NS" xmlns:sl="http://www.microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/.\oE..j........;B.,U........; .#.+.S6q:J(R.ky3.b....M..Q.-..:title><r:grant><r:forAll varName="application"><r:anXmlExpression>editionId[@value="" or @value="Office19VisioPro2019R_OEM_Perp.S.E8..H.......... ..{.......6.2>.h.....u9.;..L{;..%.%.KH...+W.opertyPossessor><tm:application varRef="application"/><r:trustedRootIssuers><r:keyHolder><r:info><KeyValue xmlns="http://www.w3..\|EEx.....s.......[.{...j...!.2u.$.3..3u Ws..k,!.d.?......X^jz4YBcYlkdrxP9EEw7iiD0tg6i0aVOgZ/FS6IxiOgZXYwTgK/BHA7QN6/lvxnecZ2cETT7w7ZRByGUN1zTQKFwXdyQz/xdp5kZ81bmI3EQWLJBT6iW5K8HZr0qRsQRlEx.\|u0............:.....f../..P.@...%.

C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	7544
Entropy (8bit):	7.101589168659958
Encrypted:	false
SSDEEP:	96:QHm3v4v+2UoKUSF9cM5B32EpRGXwDDeODs7cA+VjM/CvQBAabtA1R6iqT:Q0v11oIFPpHDjBG/E36iM
MD5:	9E5C469A9D65640FF6DBEC28EB5A8093
SHA1:	FCF367E3BD81DDCC512522EA743D15A23BDA3443
SHA-256:	F5D027344BC38C2257B46B928719FE380B763EFB44CECB8D7050CFFDC1334F08
SHA-512:	7591D1B4F8C7C118C5BD95D481D83C7C9C35DF2E42EE0845C60B2C914FE4E5700340F894117709662ACE52ACC8A49FB2F56C3EEC6A40EFE786932595D8BF819F
Malicious:	false
Preview:	.I....bu.D.l[.>..0.%3@.`C...Z.<,4...!. L\|.E..1.U!?.6......:mpeg:mpeg21:2003:01-REL-R-NS" licenseId="{00322f65-4343-ff32-0371-b2224ecc87c7}" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-SX-NS" xj..W..3w.S.%_.5..l..`!..1.....3......3.O.f.A..x..dp.,........microsoft.com/DRM/XrML2/SL/v2" xmlns:tm="http://www.microsoft.com/DRM/XrML2/TM/v2"><r:title>Office2EA0D3C6-B498-4503-97A1-19AC8?.........e.S[.5.d.u)Q.w@..O.y+!....m.&_6.e..1.O>'.<......15-a989-479d-af46-f275c6370663}</sl:guid></sl:appId><r:possessProperty/><tm:application xmlns:tm="http://www.microsoft.com/DRM/Xu......!#...#W.9.n..c3].oB..U.j)z....i.qW%.C..6..6?.......F/TM/v2" value="Office19VisioPro2019R_PrepidBypass"></editionId></tm:application><r:allConditions><sl:productPolicies xmlns:sl="hs....y".L.\|@.#.u..h~..Qa...p.,v.....<. M.\..0.. l.h.......iority><sl:policyInt name="office-A4C55BC1-B94C-4058-B15C-B9D4AE540AD1">1</sl:policyInt><sl:policyInt name="office-A4C55BC1-B94C...?`...&v....5..C"..2......q5)....j

C:\Program Files\Microsoft Office\root\Licenses16\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Microsoft Office\root\Licenses\c2rpridslicensefiles_auto.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	86235
Entropy (8bit):	6.726883872193709
Encrypted:	false
SSDEEP:	768:Eb5jj1f90e1TntXBTVFCNiDUaVoHHKD/Qyj2LWQgTIAGP7kP+zVvYtNqpj4HG:O0e1rnT30I9ontaeWQgczV8m
MD5:	0AC8F1065C0BAEDA5F2CB743A418B8B5
SHA1:	890E10E3A35DFBA55C4582ED70691F6AF532E49A
SHA-256:	84CBEBFFB99BEF4B1C4EEC4A5A13B365E487D01ACD5516830D8986C922E9D945
SHA-512:	E6DCA3E84FDF013C2E0E063E98EF1A8DFA49FF476758AECB5FA5528553B50A89C10249C4889E0F055FC92246BC07013756481AEA5E72ECAE17FFB17BDCCCDB1F
Malicious:	false
Preview:	..o.\|R....m.3.s...@Z&..9Z.....t>r-....J..]..+Q....C./..)..a'..>.. <License Sku="Licenses_Common">.. <Files>.. <File name="pkeyconfig-office.xrm-ms" />.. <File name="cliG.i.qT....b...y...%A..v(..... L7a.......@.)Y....C.$.^%..x#.Qe-stil.xrm-ms" />.. <File name="client-issuance-ul.xrm-ms" />.. <File name="client-issuance-ul-oob.xrm-ms" />.. ..=.8.....!.3.s....>I@.(c.....c.:3..........!O....GE'.Ql...H.. <File name="client-issuance-bridge-office.xrm-ms" />.. </Files>.. </License>.. </ProductReleaseId>.. <ProductRelG.n.QC...V#51.s....#MG.'4..... P[(....9..]..'_....u/8..)..L!.V="80C94D2C-4DDE-47AE-82D2-A2ADDE81E653">.. <Files>.. <File name="AccessR_Grace-ul-oob.xrm-ms" />.. <File name..\.{B...4F.3.s....yT\.(g......f7a.....,.....I6...G...)..h\|.8 <License Sku="AccessR_OEM_Perp" Acid="70E3A52B-E7DA-4ABE-A834-B403A5776532">.. <Files>.. <File name="AccessR_OEM}.x.h.....s...e..@Z&..%*.....F.{$....

C:\Program Files\Microsoft Office\root\Licenses\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1074354
Entropy (8bit):	7.274592250820935
Encrypted:	false
SSDEEP:	24576:q9WMWCqquoAtjTlLu+xFlMc7jJiPV7S5vYO5u5ZJ:q9VWCNSjTlLu6lD7jUPQx5u1
MD5:	60FE8220872A45F6C13D725B2BF11D62
SHA1:	AE5973F9DB05860EE8D6C7F1A6ED2F420F3CCF1B
SHA-256:	582816D59BA63A86FB79462D9AED9A19B4B00E119C70CC3390C40B655451EAFE
SHA-512:	8EB93005395A614F7253E08F69FC2D30619ECA2DA3156DB9AFC1692B58C88E03944FC4F3A0B7CAA460427050F4E31A11CCB1D23C68BC743D9F1CD075013C7887
Malicious:	false
Preview:	U......}S..H.v...N.4-j..=r"$.b.....iw\|P..0p...^)....J......\|.........!..L.!This program cannot be run in DOS mode....$.........#...M...M...M.....M...L...M...I..M...N...M.#.L...M......M...?.g..7.....S._...q.`..jq....(AaU(.+$._.......d.!... .n={1.#.O...M.Rich..M.........PE..d.....`.........." ....."................................................................`A..........w......}C.y..vw..N.4-j..=r2$.....O.iw....Xq...9._..J....#.\|.....xE......l....`..8...................0...(....O..8............@..h...8J..@....................text.... ......."................w.......7....v..N.t j.?r"..b.....iw\|P..pp.G.:He...JJ;...Fs.."...t..............@....pdata...u...`...v..................@..@.didat..............................@....rsrc.....................w......}S.9..6Y..".W-j..=r"$.b.....yw\|P..0p...^)...........\|...................................................................................................................................w......}S.y..vw..N.4-j..=r"$.b.....iw

C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHSAPIFE.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	2258154
Entropy (8bit):	7.583676884297365
Encrypted:	false
SSDEEP:	49152:1FOb6XuDkIx+IWZHPN9JFhHdYLP6B8JPb8jCycJlJQ5LV:1Fg6qP+31P3JF1GLPikPwjhClJQ5h
MD5:	A5C58A638C1588701B220E954FB65D67
SHA1:	63F94F172209B8FCBF59A72B523B8FD0A946DAAE
SHA-256:	D13FA91B38A02E5CC69FDDC5EC45D90493CD8D99C153EC87AA2F93DB6607A920
SHA-512:	F11331B3F1F1B46B38D8A9560F6AA64B870063396ABC261193A43DB97163C3FD92107CFA9210933421348066DC0820975B742B858E3BB9C6BFF9644868131C2D
Malicious:	false
Preview:	n>..0.~_.}....@y..J.o%.G4.P........N......].....Xr.r.A..6.9t'........!..L.!This program cannot be run in DOS mode....$........W!v.6O%.6O%.6O%.N.%.6O%.BN$.6O%.BK$.6O%.BL$.6O%.BJ$.6O%gDK$.6O%D a..,1z.K.md.e...n%Yj.kv.t_<...A.]x.%.`.9k.%cSV\|.I=+...^..;.........PE..d.....`.........." .........0...............................................p"......."...`A........................#t/.3.~_.}...R.@%..J.o%.[..Ph.....,.LJ.....z...?9X.:r.A..6.<t'.2 .8...................0. .(...`...8............................................text............................... ..`.rdata..u?2.3.}_.!.....@...J.o%..4.P......o..N..co..-.....Xr%R.A..6.8t'....@....pdata..<'... "..(....!.............@..@.rsrc........P"......"".............@..@.reloc.......`"......(".............@..B#d/.3.~_.}...R.@...J.o%..4.P........N......].....Xr.r.A..6.8t'................................................................................................................................#d/.3.~_.}...R.@...J.o%..4.P........N..

C:\Program Files\Microsoft Office\root\Office16\BIPLAT.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	562338
Entropy (8bit):	7.087536516712174
Encrypted:	false
SSDEEP:	12288:Qb3ziC5trCIZw1SPZ5bizbGNV6IE25Y+Lo2dt4Tpaw6jyf4X0:QLOQl8mNV6iaG24E
MD5:	77A69849B1C1D6640D0B0E8894D2E7F8
SHA1:	6DA3FEE4F8E3E76AB140A8391DADE45DA8673877
SHA-256:	B25581338122F6620C9E220750B7CE4EE4A440166DB33B91AD42FB80B0EA099D
SHA-512:	6FEA8F4DC5BB74CDA0DB4D2E84BD32860957964B800B8380B8FF808E414FC97BBA171FBF2422D99891C50660AA772D8023126D1FC05C2D29D86C24421878F51A
Malicious:	false
Preview:	...iw.C.uA.=o.].z.h.dD.".;.....5W...D@...!B3..Z3..e.NO..T..6...........!..L.!This program cannot be run in DOS mode....$.......ZZ~..;.C.;.C.;.C.C.C.;.CrO.B.;.CrO.B.;.CrO.B.;.CrO.B.;.C.I.B.;.C..Z+m.SPoz?~..M...}.q..aAt..........P..H..,...-&k&.u_........Rich.;.C........................PE..d......a.........." .....v.......... Z..............................................A.....`AT.[it.C.qQ.=.2]..x.dD.".+.....5W...D@...&B..Z.-.e.OO..$..........PF...N..hE......d....=..8.......................(.......8...............P....,.......................text...=t.......v......T.Kit.C.qA.=.2]......%.".x.....5....>E...!B3..Z3..e.NO.:0..w...8+.......$..................@....pdata..PF.......H..................@..@.didat..H....`.......*..............@....rsrc........p..T.Kit.K.qA.=.2]..h.$D.b.I......QA....H...!B3..Z3..e.NO..T..V..................................................................................................................................T.Kit.C.qA.=.2]..h.dD.".;.....5W...D@.

C:\Program Files\Microsoft Office\root\Office16\CHAKRACORE.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	6912706
Entropy (8bit):	7.140565825681514
Encrypted:	false
SSDEEP:	196608:wZufkTDuGm39DkgudGSti4Vju1T/rFftUm93SIhzT0/DehK+SlE1gNkfncXeZ9f8:wZuMTDuGmHufti4M1T/zj3JhzT0/DehE
MD5:	28F4292A80847BD685263462C838A720
SHA1:	009AEC52EDBFC3E4D57CB0A9AB43BB72D496EEE0
SHA-256:	B2047EDCA1B905083A4638D7C0AEFAA7BE428D68EF2BAD062DDBCD588F4F475E
SHA-512:	6A871D9F285EC3E6651B07CF3859A082EF41D0E8BF9D33239D41FE1C7DCDB6290C89B3B6F6E7B47675DC870FBDCC5BCB608E6C443F16805A28F30C10865B6E4E
Malicious:	false
Preview:	G.F:....V..l.z.w.....8....g.h+3Z......j.%s....X...\VS..............!..L.!This program cannot be run in DOS mode....$.........#...p...p...p..q...p..q...p..q...p...q...p...q...p...q...p.`.K.f_g.45..N...8i...:HI^.u,g.[(..V.aeqsV..j~.OldQ_.,....0;k...q...pRich...p........................PE..d....._.........." ......I.........P.........................................j......H.:...VR..lm..w}.....8...g.h+3J......j.5s...z8.d..\..........f......pb......Vi..#...`h.H.....W.T....................-X.(....P...............J.......`.@....................text.....I........:....R..lm..w}.....X..bd..h+........jX..%.....X...\VS.....[.data........`..F....`.............@....pdata.......pb.......b.............@..@.didat..(.....f.......f.............@....tls....w..:.=..R..lm.kw}.....8...'.h..7e.hy..r.%.....X..}\VS..........@..@.rsrc.........f.......f.............@..@.reloc..H....`h.......g.............@..B...........................................:....R..lm..w}.....8...g.h+3Z......

C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	469130
Entropy (8bit):	6.800013243437158
Encrypted:	false
SSDEEP:	6144:JtE3MSsk3C9XQkbPN0nLsViYDTDQS5UkDNkzHnDA6FhtG3Qz9OvDu51G7qWFjMOE:5dk3CKkJGsVp3fKwQz9OqOQOuv
MD5:	83F45DC2D66DF84DFC6B6BC819157CF1
SHA1:	639686B3C7EF8E5925A09F33CE91065E55E90FFB
SHA-256:	AE3729B817E0C4A51AC947192EA489DEBD76D9FE7A210CD07D045E2A8BE3719B
SHA-512:	AF8F1504D789D0E0514CD6082A9297899911102D0F9E549CD7F9DF0E06570B0A0529BF796BE7C7B0F239868A3D4399701D4943CD44808D68B86497932FFD4707
Malicious:	false
Preview:	r9>.,:\|/.n_'...L..Y...O.J(.~?.y..H.^....?& ..O..m..j..1e.C..M.?.........!..L.!This program cannot be run in DOS mode....$.......h#C.,B-.,B-.,B-.%:..<B-.@6,.B-.@6).&B-.@6..(B-.@6(..B-..0).&B-..S...xQ.<,s.''$.\.q..b).....TQ.~,..Y..d.%..)z.........iN..........PE..d....Z<a.........."..........R...... t.........@....................................,.....`.........................?s../:\|/.n_'Hg.L..Y...O..(.~;.y..X.^.K..?.%.j`..m..j.1e.#..I.?.....8....................P..(......8.......................`....................text............................... ..`.rdata..y.../../..^'X..L..Y...O..(.~..y.2,.*...... ..o..m..j..4e.C..E.?.....@....pdata.../.......0...>..............@..@.didat...............n..............@....c2r....<............z.....................yL:\|/.>^'Xw.L.~X...J..(.~?.y..H.^...K.TE.,..a..j..6e.U..E.9.............@..B................................................................................................................?c../:\|/.n_'Xg.L..Y...O..(.~?.y..H.^....

C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	594682
Entropy (8bit):	7.138599086900956
Encrypted:	false
SSDEEP:	12288:tL1XLg8sdbgpVktTmFJEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE/:dpLNsdbgbymFAo
MD5:	1E2366539E3E8A33303ED29E00E3EFEC
SHA1:	13D4250AF50058FE180851AA2E57DC83F49B6BED
SHA-256:	A813256550C03BEAE8764267F36BFD764A9899A344CB6BF05FD86B3801E6BAD2
SHA-512:	82A458D625039A617813C331599A3C55BEB674A78D58C511E61E3227965D19D856C1308791E3A4910B37CC2389B97AB99F760CB0CA2B309BDA59967564083890
Malicious:	false
Preview:	...Ml.p..u.P...._RB$..t.i."y..q............ZA,...}......$..I........!..L.!This program cannot be run in DOS mode....$..........;...h...h...h..>h...h...i...h...i...h...i...h...i...hi.i...h.-<...f.[V..-\|..9.;.>qVX.}..5n.ts\|q.....Gu:9.)....5....#e...n!Rich...h........PE..d......a.........." .....~...J......@h.......................................`......9.....`A...................Nl.p..u.l...l._RR$...a.uy..M...>.........ZA,....b.........I.@......0L..8...........................0...8............................................text....\|.......~.................. ..`....:..p.(p.l?..l1ZRB...4.i."y..q........ti.ZALu........4..I............@....pdata..\........ ..................@..@.rsrc... ....0......................@..@.reloc.......@......................l.2..u.l...l._RB$..4.i."y..q............ZA,...}......4..I...................................................................................................................................Nl.p..u.l...l._RB$..4.i."y..q......

C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	767770
Entropy (8bit):	7.3043426813882375
Encrypted:	false
SSDEEP:	12288:TW1AhlboOmjJ8NmPv0IirszOPfq1EAqhL+xZ8Dxugtb:/HMJ8Nuv0IUszOPfq1uttb
MD5:	C0894D4D34E3AF9370AE6688AD00135E
SHA1:	F82625B5CE3BD31095D13F9B16604046049FAE26
SHA-256:	7E103252488BA6D1D809110F4001EC02E04E966048FEFD0BFB29FC088311309B
SHA-512:	7CB2D22F1503EC010C0F526823D1D9063B952119F96292B32BE78116DED6B0114FB352F43AE91F17109600B9DA67CAD94096662F355A9F60AD771231A2238178
Malicious:	false
Preview:	..[..CZ.....Z...A..(.,....`k....Ut..F..n..OEZ/2E.......j.h\!........!..L.!This program cannot be run in DOS mode....$........c.;...h...h...h.z=h...h.v.i...h.v.i...h.v.i...h.v.i...hip.i...h..dzS..2...B.@iR7..........Lb...\|<..G.$...B..-.-.-..z......k.IRich...h................PE..d......a.........." .....n...........X..............................................;.....`A.............CZ....x...0Q..(.l....`k.c..U#..z.$n..OEZ.9E.....I.j.v\!.p...E..........D...8...........................0...8............................................text....m.......n...................C:..x.....'."...lq....i....Ut..F..n..O.tKS1......j.)W!.....,..............@....pdata..\........ ...:..............@..@.rsrc... ............Z..............@..@.reloc...............`.......CZ....8..C0A..(.l....`k....Ut..F..n..OEZ/2E.......j.i\!.....................................................................................................................................CZ....x...0A..(.l....`k....Ut..

C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000C.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	766714
Entropy (8bit):	7.27468722556205
Encrypted:	false
SSDEEP:	12288:jtPm8WTko7MpcJdF2EEEEEEEEEEfEEEEEEEEEEEEEEEEEEEEiEEEEEEEEEEEEEE6:Yx7MSJSyH6W0qTU
MD5:	91399BA498909EA430EDB35990D874AD
SHA1:	AF373760168E0DEFB0167FF74E9BA90D69E083CF
SHA-256:	6D7360B7CDE60F0079D9826047F74F3877EAA83C5EA34249112E6B8DC21E5E0A
SHA-512:	FFF90A567C6129CBFAEFB1E271A87CD9D2CB2C90A792E21BCEDFD23AC3A48C2C50AA34806DD3A96F4A81E859DC3C3F8B7729F8E15955FC82453B3C0DC00CADC5
Malicious:	false
Preview:	..\E.6..)...`.......}D.i8......,..(..t....Q^c..8..G....B..PX.........!..L.!This program cannot be run in DOS mode....$........c.;...h...h...h.z=h...h.v.i...h.v.i...h.v.i...h.v.i...hip.i...h,.c,.4...j.B..W.:.?..KNr...iZ..S.....YS..z....E{t....;S..Rich...h................PE..d......a.........." .....x..........Pb..............................................F.....`A........E..E.6..-....@..5...}D.)8.>..........t....Q^c.j3.9B...0I..NX..l...E..........D...8...........................0...8............................................text....w.......x..............E..E.6....qc.!.......F.).......,..(..t....Q^#..Y.xG..E.B...S......&..............@....pdata..t........ ...4..............@..@.rsrc... ............T..............@..@.reloc...............Z..E..E.6..-....@..5...}D.)8......,..(..t....Q^c..8..G....B..QX.................................................................................................................................E..E.6..-....@..5...}D.)8......,..(..t

C:\Program Files\Microsoft Office\root\Office16\ChakraCore.Debugger.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	851042
Entropy (8bit):	7.147422679506918
Encrypted:	false
SSDEEP:	12288:UtnBFh++pErRmivtCO4K7zVtXXAfpPC38iMuYF3HqPiyGvgMZxKJrMF:U5cnrRmItCK7BJXApPCnMuYIP+gMS5MF
MD5:	88647760B3B43336A15C88F6FA378CE2
SHA1:	E7D6B912DFC59CC1C3F3D19C42D07BFCD2A30161
SHA-256:	B6A903C232C2767DE57E98D08C55D2BDE16571799D781E59D87A731BD58DAB88
SHA-512:	5CFCE5E86EA6BA12D22C3399D4C3592B0BA6BFD9BE7C1589485E7BCFA611F04F90BE4AB237C770A570E7B421B4A7021FB4FE7C2BE0F7140A34E6EF7E26038602
Malicious:	false
Preview:	.......E..a3....}...a..>..K...a.q.F-.O...Ox..G8..U%n.k.........!..L.!This program cannot be run in DOS mode....$.........................q......q......q......q............QR.;.tq]"..C.....v&.......... <Iu..o.,.8x.}.-.......K..U%n.j.........PE..d....yH_.........." .................Y...............................................}....`A........................J.a......E.N..a+2.........&..K....q.F..O.J.Oxr..o}...)nmc.....p.......................(.......0............0...............................text...K........................... ..`.rdata...,`.....?D.^..a.....}...a..~.ec...q.>t.O.8"Ox...G<..U%n.j.....@....pdata..hR.......T...V..............@..@.rsrc...............................@..@.reloc..l...........................@..BJ.a......E.^..a.....}...a..>..K...a.q.F-.O...Ox..G8.*.U%n.j.................................................................................................................................J.a......E.^..a.....}...a..>..K...a.q.

C:\Program Files\Microsoft Office\root\Office16\DBGCORE.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	175370
Entropy (8bit):	7.025100637360019
Encrypted:	false
SSDEEP:	3072:V7tePiRBL0y/f3w5l0yWApJrQxCuo27lGWVqxKCCPdfuTFg+7gDp1kSSIKG8b7:V/L0ygn0yWWQxC32JGQECPdf/gSqG8H
MD5:	AE43940529A9989AE23CE148E4B11270
SHA1:	AA3A8E949CEBAA068456AAD0B147A3C828D8C918
SHA-256:	7C95C6A3514C41F8519133E318917352A81E57FC8495478C390F08CE511217BF
SHA-512:	183DF0E80CB18380D3284EA963C82A34C2D302E1CC9EB26C8F387C97B003B37A6568525898FA1128D94CE0AA70933D115CD7DEDADFF166ED75638B046D3C97B4
Malicious:	false
Preview:	]..\.."....j5..2.z...O.{.....zl...<.a>>....v..=.d...<.m<[5...........!..L.!This program cannot be run in DOS mode....$............_._._...^._.._.._._..._...^._...^._...^._.X...@.....47.m...i.~.q...^ N%.~....al.....a.=.d...<.m<[5...PE..d...q..........." ................0...............................................'h....`A..................................J\..".*..j.Y.2.D.....O......zl...a>>@..6W..=qf.{.<...Y5............................p................................................text............................... ..`.rdata..v}........J\.T#....j.Y.2Az...........zL...<]c>>....J..=.d...<.m<[5...S.pdata.......`.......>..............@..@.mrdata..,...p.......N..............@..@.rsrc................\|..............@..@.reloc..l.J\.Z ....j...2Az...O.{....8l...<.a>>....v..=.d...<.m<[5.....................................................................................................................................J\.."....j.Y.2Az...O.{.....zl...<.a>

C:\Program Files\Microsoft Office\root\Office16\DBGHELP.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1869578
Entropy (8bit):	7.071375159957892
Encrypted:	false
SSDEEP:	24576:4zPqUcpuNfeXu19rr40lqz0mpag9rEO8wParsQCOy31ZzTnL6N3M5yP:4zPqdKmejr80lqzMsrzHNnOyHLLLw
MD5:	0DF0DC00B63EBA3F60D4F43D88D6B361
SHA1:	C8658F7E18B512F5200D20D8777A10B1A5DAA0A0
SHA-256:	6C6A0403B41600E7AE39A23EEE8CB7ABBFB93625BADEBAB1C3F543C811F93A63
SHA-512:	3E6E612644171DEFC8030E46A0C99F7A8E235511DCBEA55BED9FE1879B8908F1074C513441473075919D1D6F9A66B0D539A94B1FE434BEB3C112F5D40FE9FDD2
Malicious:	false
Preview:	hr..P..'U..q.. L...].....u.pTS..D......a...e....y...X..P........!..L.!This program cannot be run in DOS mode....$.........K..r...r...r.".w...r.".v...r...s...r.......r...s.W.r...v...r.....\........8v....m...X...%.h..~..\m.BK;.....~..J....;..blH........................PE..d...;Y............" .....Z.......... .......................................0............`A........%8..S..#U..... ....]..n..e.p4...h...L..9...e#...y..dD.q..P.d...!.......L......p...........................`l..................0...,...`....................text....X.......Z..............%(..s....'..... ....]..nm..u..pTS..D......!...K....y..Z..P....................@....pdata..............................@..@.didat..8...........................@....mrdata. -..............%(..S..#U.....`.y..>..>..u..pT_..D......a...e...y..=....P.L.......N..................@..B................................................................................................%(..S..#U..... ....]..n..u.pTS..D...

C:\Program Files\Microsoft Office\root\Office16\DIFF_MATCH_PATCH_WIN32.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	97930
Entropy (8bit):	7.334079898169449
Encrypted:	false
SSDEEP:	1536:fSKWU/GzDSTd+8WWm/1DzngwNryPDIjaBbxWiKL+3AQuP8CLnV5OIH7qW79X:fBXG/vFt/1/gwNrKPB8vL+3FuPxV5xq4
MD5:	EFC746CB2F5ACB33E98D9D501B6F0D08
SHA1:	954643CF440168746DAE24EDBE87AEEED699D5AC
SHA-256:	4631DF10257D68BAD283455DFBCAD801C41240AB6343BB37F181EC17E45AF477
SHA-512:	4FF716C6390B74C8F8DCD41175853F2CCAB56760972FA9D50BF77009F8395622D7594D8F05E223CCD39854E8D6E652EAA6A31F25607F96F2257E73876D481AEF
Malicious:	false
Preview:	......'..?..!)...G.Y~l....7...7.....g....+]...,.p...e8.............!..L.!This program cannot be run in DOS mode....$.....................+................................y..XRG....:`.d@I.."...km.$W...e...T.z...g....+]...,.p... 8.!....`.........." .........B...... ........................................p......MV....`A.........................................9...'.g........G.Y~l....7j...6.....g...Q+]..,.p...e8.E.......................8............................................text...G........................... ..`.rdata.../.......0........8...'..?......8#.-.l....7....7.....g....+]...,.p...\f1........P......................@..@.reloc..T....`.......6..............@..B..........................................................8...'..?.......G.Y~l....7...7.....g....+]...,.p...e8.E.....................................................................................................................................8...'..?.......G.Y~l....7...7.....

C:\Program Files\Microsoft Office\root\Office16\DLGSETP.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	166554
Entropy (8bit):	7.146060373500532
Encrypted:	false
SSDEEP:	3072:xE7hJ6KvRWa/VdYSTIC4kqDZOg4TfLJ9JKdvLW2YKFJvMCwwoPQ5wEw281yGwJ:xob6+WeVD0C4kqDEnJ7Kdvq2YKT0w8r2
MD5:	534813F79374A251D26BCA585B9C519C
SHA1:	BD6CD79449BEAB357B48F9251A039425DFBA3E49
SHA-256:	A877DBC0242BD69CD26F79DAD82AA293D9C41F339C49A60553AF77BF6077FCE0
SHA-512:	1914FF5BC29377A8C07EAE5CF9D197E39F17AE12C2F985520593BB528DE014ACC445F5FD636648910B02227AF93D8EB7964743AAE6272156798273F12AEC8416
Malicious:	false
Preview:	q....M...=.8Vx......H.T..]:..z...4...h....'..E]@J...t.Md........!..L.!This program cannot be run in DOS mode....$.......(.U.l.;.l.;.l.;.e...~.;....n.;...:.j.;...?.d.;...8.h.;...?.o.;..9`x...E...#.)m.M.._f....}o....[.A....o.GZW.F..f.<^(.{.wu\...v..9.m.;.Richl.;.........PE..d......a.........." ......................................................................`A........<.Z..M...=..K.VxM.......T..]:...~..4...i......[@J....Md.D..`E......X.......8.......................(.......8....................... ....................text...\.......................<.Z..M...O..?.Vx=y...%....T...;..z...4...h.....C..$]@J...lOd....................@....pdata.......P......."..............@..@.didat..`....p.......4..............@....rsrc................8..<.Z..M...=...V8cj.x...P.T...8..~...t...h....'...]@....l.Md................................................................................................................................<.Z..M...=.K.VxM.......T..]:..z...4..

C:\Program Files\Microsoft Office\root\Office16\EMABLT32.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	165562
Entropy (8bit):	7.081650957462693
Encrypted:	false
SSDEEP:	3072:rKaZ1psSUKFC94S+CC/eDdZnYtAiswhO0sPdtddEEHamjBM:rd5C2SbrvYtAixhOH0EHamjm
MD5:	45C326D1F2B3F905C2852935136DF29E
SHA1:	2B69D6828FDE8290F01C26453B875FED62A86EEB
SHA-256:	8CC05DA73A14188B93F7B58F91B6B7F07D65A21F6AEF37107D7541CA0536809B
SHA-512:	158E70E5CDFCD958B7AE61F33A6C175F668C1FEEE6FC524A074DEC8B2D995F099C0F7B0863C71315BD18B30B7FE56FDB2FA879B25C732252E064241073B20420
Malicious:	false
Preview:	,..VC6.."M.(.N...g._.J...cL...n.4}*..FE.37Hd.+..&M.;.yh;..........!..L.!This program cannot be run in DOS mode....$........^+.?E..?E..?E..G..?E..KD..?E..P...?E..K@..?E..KA..?E..KF..?E........PA...f.....#)m9."._".P6F..8..'I.).s..[E...H...~d.......lKG..?E.Rich.?E.........PE..d....t.`.........." .....................................................................`A........a..V@6..&M...N...g._.J.I.cL...nb.\|G..F..27Le.+...&..;..{h....@...E......T.......8...........................p...8............................................text...........................a.V`6...?..N..g._.K.IJcL..n.4}..FE.37.d.k..eR,.;...yh#...&..................@....pdata..(....P......."..............@..@.didat.......`.......2..............@....rsrc........p.......4..a.V@6..&M...N.6...0eJ...cL..n.2}".FE.37Hd.+..&..;...yh#..................................................................................................................................a.V@6..&M...N...g._.J.I.cL...n.4}**..F

C:\Program Files\Microsoft Office\root\Office16\ENVELOPE.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	233658
Entropy (8bit):	7.079732692652421
Encrypted:	false
SSDEEP:	6144:Fa05/7WoOnMtGy3JvKP0sbEdfFqzlcVO63ww4Vh+:k0RWoOMtGuhsArMl+Uq
MD5:	0941DBF96AE07FD56759F80D7A5BB95D
SHA1:	84B114100DD8447E210184D18169C5E834E420BB
SHA-256:	AD42C701A5FE312A06C1C6C0B421529B56539D0013B08D70FB4B58DF6C49FEB4
SHA-512:	213EF4C6E7730B977A94C7F9FF71979C1C603E0BCCE10B2D5E79CBC6F5F8DEBC06C945CA6B31C269F1C114B5FCBB59FF356002534454610F881AFCAEA36DEDF0
Malicious:	false
Preview:	.+o.e..v....FG.....%..Z`......H...h#./f./....3.5.......W..........!..L.!This program cannot be run in DOS mode....$.........$..~w..~w..~w...w..~w.w..~w..v..~w.zv..~w.}v..~wR.zv..~w..`.....o.z3x}....RZh$. ..n..6.w..U...]F.......-D.....Q.B.P.a....w..~wY.\|v..~wRich..~w........................PE..d....y.`.........." .....`...........P..........................................f..vH.....c....%..Z`......H...x#./f.?....3.%.......CV.....,....`.......0.......J...E...p..........8................... ...(...@...8............p.......... ....................text.......f..v...........%..Z`......H....BcNf......93.5.......V......@..@.data...H...........................@....pdata.......0......................@..@.didat.......P.......6..............@......d...v...........%..Y`......H...h#W/fj1]....i.3.5......................@..B.................................................................................................................q..f..v...........%..Z`......H...h#./f

C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	652
Entropy (8bit):	7.10317867247107
Encrypted:	false
SSDEEP:	12:g6H0rMeDt+yRIQ6jf5Qs3MPRlaj2flj0+DG01QUC2e9+rt0sC6wsGA0E/OgH:g6V6t+yR36jf5QVDaGI+/SUCmY1t01
MD5:	AD5D3CF31CC1C4CE3557BCC3D78621D4
SHA1:	951D8AAC869E1E126615135BF6C26ECEDB75C7C0
SHA-256:	292DEA522DCF47EE309D9F44A14CA7A94267368B8CEC68AC6AB088BAE078EA68
SHA-512:	07041D3BD2D658C78278D106CA17851C84D3E29ED5547874B46B68788081BD432994AFDD1524B75646C0B2DEB9E57EEBB20E08EA2CB78EE6680758FF62E87714
Malicious:	false
Preview:	....R..*b.P.JU.....lg7..&Wj.Qr....1Q...o"..e.;.A.,z(..N..t.1....\|m.B.N......\|wb.....jn..j...I`......l..,....].mn...P...n.U....4-.[.mY.....&3p....$^...i...K\|....f..<....A.Bc(v.S...\|.v.X..ww.y.^S.......?23....A<.CK....1"....C3....7.K.@m"\|.M...=.b....qr...uS.....!.?...\|u..k...H@....^<..2....].mn...P...s>..</Application>..!.Ot'.(.A.^&..MS..nT....".....O.V .[......5u./y+g.8.?..[..'.M.$~....a..C.R..s.ZOo...\...1.w...p..p.....S4.dW1.....h...SEf/C..H......^8(.D....r...K\|.L.j.X...C...)....x.....E.Z+......N.SV.0.i..G...Lr5.....................................................................................@.........vux2f891j9j.

C:\Program Files\Microsoft Office\root\Office16\EXSEC32.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	504378
Entropy (8bit):	7.17769108375877
Encrypted:	false
SSDEEP:	12288:7Ufeuq8BWJd1C2Z6y2+1yfCkXDdhP9cNjqDPM7J8nB8c7:ofeuMj1CbdlfCkXDdhP9cIDPMF8nBz
MD5:	E59842D7979DB3A4A152ABCEED54743A
SHA1:	1DD13B31425E2EE66AE865AE99C02197DD8521D5
SHA-256:	F6AC1947A02829BE2BEB810ED52A2EC1B0F3709896BEFF123408C3DA13F07178
SHA-512:	A6F8BC1F8A1D49592B0AF987313BAD0600694787B88ACDE2DCF8711C9FFE655561C8CDF9DFA01D469226D6BEBE23E49D598C1D99A682EA4938EB34903CC01B14
Malicious:	false
Preview:	9."..1.g....,./.....H..?.Ot...3.R...f%=.6...........w..........!..L.!This program cannot be run in DOS mode....$.........)..G...G...G..f...G..jF...G..q....G..jB...G..jC...G..jD...G..%.$./....LUk1&a.E............o.......(...q>..+....Ug.u..h.XijE...G.Rich..G.................PE..d......a.........." .........\............................................................`AtI...1.g...K,.......H..?.Ot...#.R..~`%p.6..!.......<...p...`...-...l...E..........t...8.......................(....1..8............ .......... ....................text...................tI...1.g...K,.......H..?/It...3.T...f%=.6...T.......@v.......0....... ..............@....pdata...-...`.......(..............@..@.didat...............V..............@....rsrc...........tA...m.g...K,............PlOt!..3.U...f%=.1..........av..................................................................................................................................tI...1.g...K,.......H..?.Ot...3.R.

C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	75426
Entropy (8bit):	7.048544567699027
Encrypted:	false
SSDEEP:	1536:NdrrZV5r7E8R15zC5gssaZ46tWhguIQYz8zSal5ERmUi9YQl:d/rY8R15zC5pJZ46+guIX8zlw3y
MD5:	1710F853BB87D9C4C9B89E1D1CCDCEA9
SHA1:	BA53B4FD8F1B5E1738DCB6886668ABE520C5ED55
SHA-256:	0312A0681B537A106C8D7ADB427A2D7010DED87D1AA7C61E33FB59DCCD69521A
SHA-512:	AE367B0EB11D647202AA29A63E58217369AE8D47837D1993BE07C27520F1D2E198562C26E93A9DF3CD01A17603532C4E43FD6AF03C3CDDD5F51830BCB867597F
Malicious:	false
Preview:	..2.R.!O.jT.T..T._...\|...a.!..=..>.._Xk..UD.l;...v m.D..$.\|.[.........!..L.!This program cannot be run in DOS mode....$.........h..o...o...o.......o......o......o......o..)....o......o......'...m.......X...zh..g.......=.[0^...Z...=4...BA. 8..]nRich.o..........................PE..d.....`.........." .........Z.......~.......................................0.......S....`A....Q.!O.jT~.....O...\|...a.!..=..>.._Xk..UD.l;...v i.D..%..[.....P.......hE... ..........8................... ...(......8............................................text......................Q.!O.jT^..b.;i..\|.B.a.!).=.G>...Xk..UD.l;...v -.D...E.=.[.............................@....pdata..P...........................@..@.rsrc...............................@..@.reloc....... ......Q:!O.jT~....._..\|..a.!..=..>.._Xk..UD.l;...v m.D..$.\.[.....................................................................................................................................Q.!O.jT~....._...\|...a.!..=..>.._Xk

C:\Program Files\Microsoft Office\root\Office16\EntityPicker.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	269986
Entropy (8bit):	7.0041292888599
Encrypted:	false
SSDEEP:	6144:qSqv1/sQVaGULYujWd4uWGgrURmF6Mzb+OWofJAUP9JxcfE:sv1JaIujWvWGUURW2+fcfE
MD5:	C910AC3082A2AA7746710FD63A72B958
SHA1:	77E10C207A86AF815F4A960D112E6F10487D38E5
SHA-256:	3184283FE776C7371F1F33333423981E8717056BD1511F75FF0DF1E099EB3110
SHA-512:	4C558F7600FEFA5C8BA5C9D16EEF5E0EFE8C6D93FCF050DA96E2F7E44AF4853BB8A773CDA7489E90C447A141C4BAF4AD9BB2E9247B0C1CD49AE846E018B80D1E
Malicious:	false
Preview:	......Q...f.W......\D.....L....y....q.......7.pC.V.7I6g........!..L.!This program cannot be run in DOS mode....$........6...W..W..W../D..W..#..W..#..W..#..W..#..W..%..W.W.G...i.....Q\..~]......UF...e....[nb.R.X..5'..p..d.........#..W.Rich.W.................PE..d...t.`.........." .....l...h.......V....................................... ............`AK.....Q..fm.........\......L....i....i.......K.pC.U.?z6g............hE...........9..8.......................(.......8............................................text...\k.......l......K.....Q..fM...2....\.Y...oN....y\|...q.......w.0m.7.vH6g.#...p.......^..............@....pdata...............z..............@..@.didat..p...........................@....rsrc...(2......K....\|.Q..fm...........*...L.....y....{...j...7.pC.V.WH6%................................................................................................................................K.....Q..fm.........\......L....y...

C:\Program Files\Microsoft Office\root\Office16\ExcelCombinedFloatieModel.bin

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	994730
Entropy (8bit):	7.7007252044633265
Encrypted:	false
SSDEEP:	24576:fmTKNvjZksNFyQxzaXVL2j2NPe6/nR44gEalwk0Y0i5PFBGuRyfa:fmuNvjX0MaXVDP/fLgEewk03i5PFou4C
MD5:	2447A0D6F3E358742EA97AC342B1E1A4
SHA1:	182A8107A088F408EECF7977F1D9DB9ACD556D64
SHA-256:	B456CDCB38D8AA87329DBFCBD590ABDA54CA08380068EA5AAC8D3F57227A08D7
SHA-512:	0D698C87B9073B41639590CA94E895441ED6045DE808673210FC197E94EA5F6987CC270E2E4EBC1906D4BEE6ED7F38C3772D9C67508E20DB4C9986C40AA1D4B1
Malicious:	false
Preview:	..Y2.M.7`....R....[.Z^...o.vu...v/.x.U..-.t.^...55..(L.Z...=......F..P-...<...Y...3.......<..o...q....6...,...-...<..r...~^..<_..%....-.......6..O-..z....6..=1.......-.......<...R......W...!.Y2...7{..f.R.)..[.....u.[....u/..U...t.O...45..;L.#...+......7..8g..D^...6...6..............$...y...._...7......H_......m........6.......`..P........M..Q3.......z...:..DG...........z..N.Y2?{.7....R....[c....s.[....../...U...t)I....5.. L..d....._..8_..tb..}....6......J_.......F.......6..y....3......./...f...........-...2..w........-...<......s....6..Z....6..=_.../...k..2.Y2.).7f.%.R....[Ef.....[I....n/..U...t.!...O5...L..2..%7..7...F...I...6.......,...2..>_...F...F.......2..%1......r...pi...6..T/..................$?..Y.......t.......o........-..0_...2...Y2.M.7....R....[.....s.[.....j/.9.U...t[I..K45..EL.............8..^0..D...._...6.........../.......,...6..;,...6...0......{......../...k......h....0..&..../...;...I..........W........:....Y2E6.7..:.R.G..[..Jz.[5...Pi/...U.

C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellLayoutModel.bin

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	345646
Entropy (8bit):	7.655679154841314
Encrypted:	false
SSDEEP:	6144:Wc91lrW53CmKIJ3Ml4YlWILk3XFslVhL5q1LRuePtrP2S/P+OWEKFyU623+lUH:x1lrqC7/l4jIiFsP/qTBPBPP/mHEKkrW
MD5:	B120460AEE3E179588EADCB6E143896D
SHA1:	570E13BBD08B7956B894FBB57D780DA498B98728
SHA-256:	F77B5415202172F7AE1045858A19A89D19AE0F4555F352C03D273B9C1847DB9E
SHA-512:	89ABBC7DD5D604BF1CABBC1B55EFEDA1B5B7DD58DE446B6A1A2B6B663B5925613E10D3CE2B283B77809DCF9A70710B3DCC9DD3E36FC6C02E8952258FB42BFD4D
Malicious:	false
Preview:	R.@w.i@>..S...\}...+Y3.8. J.5......k.)`>.$.wk6..!..t...^N...K&c5....%...;...<...j...l...q...r...s...x...y...z...{.................................................................................@wci@>F.S.V.\}...+R........].)..k.(`>=%.wI7.....t...^q...v'c5/...4...9...<...=...>...R...l...q...r...s...t...u...v...w...x...y...{...\|.........................................................@w.h@>!.S...\}^..+`........]...k.(`>.%.w.7.....t(..^....A$c5...."...%...9................................................................... ...&...)...>...H...O...P...Q...T...W...X...[.....@w.j@>..S...\}...+....X....].b..k.`>h'.w.5..A..t...^-...%c5w...y...z...{...}...................................................................................................y.............@wEl@>..S..\}...+.........].:..k./`>,".wZ0.....t...^b...g c5D...E...K...M...N...S...T...W...k...............................................1...3...6...7...9................................@wNn@>~.S.R.\}{..+J......8.]....k3.`>

C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	365094
Entropy (8bit):	7.653123587274362
Encrypted:	false
SSDEEP:	6144:x4Ag2OfwcmzxaUEu6I/r3fyHxdtdvYDo3yJo0Z6+/zVL064FvvvZD/YhOvxG7J4b:iLRfdsaULjyRdzveIyJo0TxY39/YhOpN
MD5:	B0846CA2DE0EEC9C3FEBF00D99CB5134
SHA1:	241242438ED35E8496B5BF69B0400A20B5E2F801
SHA-256:	D60FA39A3FF52FBF716EEC0A791B01F3E0250854764C6DE9D2891A6999BABD16
SHA-512:	42A7AE7B0EFA5FE477EE98B54CE09B7E184917518FA31B9203A02C862E302BDA9F302F401C11813D2126041FFA3C0F6222A2126C636D0CA1DFF4195BFFAB66DA
Malicious:	false
Preview:	f`...2.;.N...6..w.u...=..?I...?Y..6........&.....s....VP..............%...9...:...;...<...j...l...p...q...r...s...v...x...y...z...{........................................................`...2.;..N...6.ww.uOy#b.3{...m.??Y..6..S..:..&Y...7s.......P.................................."...$...%...&...'...(...)....../...1...4...9...<...=...>...R...l...q...r...s...t...u...v...w....a...3.;S.N...6.Ov.utx#bI2{.J.m.u>Y..7.....i..&....zr..d....Q...................................................................................................................................a..B3.;".N...6..u.u.{#b.1{...m.=Y..4.....\|..&....uq..m....R...................................................................... ...&...)...>...H...O...P...Q...T...W...X...Y...[...\...]...=c...1.;I.N...6..t.u.z#b.0{...m.<Y.j5.......&....p......2S..r...s...t...u...v...w...x...y...z...{...}........................................................................................c.._1.;..N.G.6.(t.u.z#b60{.6.m..<Y..5..

C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	113254
Entropy (8bit):	7.628695229570478
Encrypted:	false
SSDEEP:	3072:s8SUH4ze6BMEHoAeH5HONh4x36opUz3B0lbGTQu:EUYBMEHoAyHMux36ivlA
MD5:	1324726C43E2D7CEDCE2C7FD170B0BA9
SHA1:	5A658174DF8E4AA615B7ABF87E5AD02EE2D737B2
SHA-256:	C455DC3E97570CAD1C6B3A91FEE625BB8276D2C473A90055693D2E415CCADCAC
SHA-512:	43C39A937702B74198BAE3925149FE63A6BAB30339C05A3A8A84DCAA913FA1859E51104EF6A12446BDDC20398CB29C996ED104CB6F1A2B29BC2A5C9CE754C70E
Malicious:	false
Preview:	.8..._.7.9....X..fX2*_...M. .Od........"5(ZX....`..^^.#........%...:...<...j...l...p...q...r...s...v...x...y...z...{........................................................................8..._...9....Xj.fX...r..=.J.....6...."5.[X....\..^b.#....4...9...=...l...q...r...s...t...u...v...w...x...\|................................................................................9..._...9....XX.fX......=;J..1........."5.XX....L..^..#x............................................... ...&...)...>...H...O...P...Q...T...W...X...Y...[...]...^..._...a...b...c...f...g....;..._.E.9.l..X..fX......=.H......k....."5VYX........^..#(...................................................................................................y...............(...).../...0....>..._...9.&..X..fX...S..=.M......X....."5b\X....."..^#.#4...........................................2...3...6...7...9........................................................................0..._.6.9....X..fXM.....=RC.........

C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieTextModel.bin

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	485142
Entropy (8bit):	7.667543032952542
Encrypted:	false
SSDEEP:	12288:M1VfWkVqwazN0YTwSfx391amFHUUutNvNPCqvIjWKof:M191qwazN0YTtxpHNKFPRoWRf
MD5:	A8921E91B37159B6179DB3F6B9AC4FDB
SHA1:	7F0F48765021B948761679F0D08B520C63E9E800
SHA-256:	87DB66EEFA215F2EA731865A572C343CD570632CEF1064BBC1551DB948973914
SHA-512:	EBCB87E59B33343A4F03900E8042FD0DC72B5E675765C3F73E9C71D7302A3803465141E62DDC8C4EFBA32FA97C0B10BD294F4ACB2BFF3FB4129C40C1B757DB35
Malicious:	false
Preview:	..!..G..c<.NB.L3T...-....9..Rtg.f[..$_.\/....E).5_h.6....x.=\............%...9...:...;...<...j...l...m...p...q...r...s...v...x...y...z...{...................................................[.!.~G...<.`G.L.T....0.O/x.S....f[.$__\/.P...).5.h.6p....=\............................................"...$...%...&...'...(...)....../...1...4...9...<...=...>...R...l...q...r...s...t.....!.F...=.F.LKU....0...x.;R...f[m~$_.]/.....(.5.i.6#.....=\.................................................................................................................................!..F..=.7F.L.U....0..-x.\Q..{.f[.}$_.^/....m+.5.j.65.....=\........................................................................................ ...&...)...>...H...O...P...Q...R...T.....!.D..8?.D.LnW..1.0..,x..P....f[.\|$_._/....1.5+k.6......=\i...j...n...o...p...q...r...s...t...u...v...w...x...y...z...{...}...............................................................D.!.nD...?.oD.L.W....0.-,x.P....f[.\|$_

C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	339926
Entropy (8bit):	7.665607028905089
Encrypted:	false
SSDEEP:	6144:vcvB19N2j7xahJ9xd3/BlZioxNdDkMnHK3nFfRDAkPQX36wZhRU28DCxBI5:K19N2fMzpkX3FtAkPw6MPmmbI5
MD5:	93BC4690DFF7FC55D8F08A2F38B9FAFD
SHA1:	18A6CEFE66D55376B369BC01CF43AB9BB0F555D5
SHA-256:	0B37CDBF0364AB2746D9944EA09992553DF29A7DCD81FEC1D5D52849D70D8DFE
SHA-512:	6EEC4779EDB0672F9CA3A5A699C58E36F27A673D2192F8D40F324FF80105DA48DE85A4D3F1173110C744673F98217772CC3E132268D0AC374CDE60F14B5F1D2D
Malicious:	false
Preview:	.....%....g....x.# ..YXkg..f&....t..i..G.Z[..D>........3.m AV.........%...9...:...<...j...l...p...q...r...s...v...x...y...z...{....................................................................%...g.....# ....H..c......t2.i.ZG.ZG..D5........2.m.@V.&...'...(...)....../...4...9...<...=...>...l...q...r...s...t...u...v...w...x...y...\|................................................$....g.....# ......c..../..t..i.oF.Z...D...`...32.m.@V........................."...%...9........................................................................... ...&...)...>...H...H...[&.N..g......# ......cX......t..i..D.Z...DN.......0.mRBV.f...g...h...i...j...p...r...s...t...u...v...w...x...y...z...{...}....................................................................&...g.....# ....p..c......t3.i.PD.ZW..D4........6.mLDV....................(...).../...0...1...4...5...6...7...8...9...:...;...=...>...D...E...K...M...N...T...W...k........................#....g.....# ....X..c3......t..i.

C:\Program Files\Microsoft Office\root\Office16\ExcelInterProviderRanker.bin

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	817734
Entropy (8bit):	7.691481538211477
Encrypted:	false
SSDEEP:	12288:Apu6hMtiGvD/ygkhRfCXLALqFS8yKrthPTPjMgagwT/mfFS8CwDZVpxN+o:Wu6GfygkTLqE83RPjmzmfFfCw9VDYo
MD5:	A6C85D5634E7F3F9BC891DB2C3A053C3
SHA1:	10153824DA70880CBA73D1CD8398D474B3F2B0A1
SHA-256:	B81A2CE0637964E6264B5DA1937109BE63178D066FEA09FDD6BE0314CBC9C852
SHA-512:	F0737174455367D8387A0D018DEC71E605E8DF75F7FE680E143AECF84339EAB489398413F94A77855B363831DBED5A37C772B8E1FF01DD6AEF7707B2B1164A15
Malicious:	false
Preview:	.~t..&..S..$.{...p.l.2.3..#[%......g..x...?d:4J..#..9J.....e.............................................................%.......9.......:.......<.......j.......l.......q.......r.......s....~t...&..S...{...p..r.O+..#&.I..........x..p?d:,J.....9R...j.e......................... .......!.......".......#.......$.......%.......&.......'.......(.......)..............+.......,........~t.@.&.#S....{..p.s.O...#..I.....w...;x...>d:.J.....9z.....e.5...)...6......7.../...8...4...9...9...:...l...;...q...<...r...=...s...>...t...?.......@.......A.......B.......C.......D........~t./.&.KS..d.{.B.p..s.O{..#3.I........Cx..q>d:\|J.....9....u.e.M.......N.......O.......P.......Q.......R.......S.......T.......U.......V.......W.......X.......Y.......Z.......[.......\..."....~t..&.SS....{.Z.p..p.OS..#<.I........kx..5=d:TJ.....9.....e.e.......f.......g.......h.......i.......j.......k.......l.......m.......n... ...o...&...p...)...q...>...r...H...s...O...t...P....~t...&.{S...{.r.p..q.OK..#..I........

C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	187354
Entropy (8bit):	6.946943710715921
Encrypted:	false
SSDEEP:	3072:ZK0WjorK9On+oBePx9iGKWe1TIokR0eioSUVw5OROlw4+G03k:ZrPri++2XGKWeRIl+VGVw5OROlt6k
MD5:	AA183BA5118EA746E9A5F805257FF226
SHA1:	EB53D7BB3836BFB3B3D20B6BCFF0FAD28655394A
SHA-256:	6EF83F77D06E86E98D942BDC629651289E88A965754D2F7AFBE152FC12A708DE
SHA-512:	5E03F27157B3B3C45CB1012531A0E84C79BA3AFD1A2BA3A96756B20A7E589B54F4B862E26CC6AC8B19028BD8C9CCDD1EA0AB2E7B9B703D6358647333DB74F31D
Malicious:	false
Preview:	...};.T..V..E%._.-r..sjm.........k.=UnDJ...)i.y..G...q..{.X..o"........!..L.!This program cannot be run in DOS mode....$........R...3.N.3.N.3.N$DoN.3.N$DjN.3.N.3.Nf3.N...N.3.NF..N.3.N...N.3.N.?.3.....e...\.r..@.#B+..*.4_T.q..f.......Z.7\|.$x...{.X..o"................PE..d.....t[.........." .................o....................................................`...................}8.T..F...._.-r..sjm.........i.UnDJ6...m.y..E...q...X..o"...........8...............................p...............0............................text............................... ..`...L.T.?...z._..r...km.........k.}Un.d..Hi.y..G...s..e.X..m"............@....pdata...............t..............@..@.rsrc...............................@..@.reloc............................}x.T..V...._.-r..sjm.........k.=UnDJ...)i.y..G...q..{.X..o"..................................................................................................................................}8.T..V...._.-r..sjm.........k.=UnD

C:\Program Files\Microsoft Office\root\Office16\GFX.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	4991618
Entropy (8bit):	6.750676048090207
Encrypted:	false
SSDEEP:	49152:k84QeU6pl5J99VVwl00J/m2TlY62TuzSLfpKkLLTyDn1cxsvCzapw0N/U:kLOol5P9LwjLQMOLTNT0lU
MD5:	384F7657DA535A7658DAC92873F7B12E
SHA1:	962FD744154C35D6C625935556D70DE8B3122419
SHA-256:	8B63AAABE13A0D6B444C9BF61714167A43D655F50D03A3C49D0BA3DDB75871B3
SHA-512:	0C4F5318241FDDB6884EC29547ECAB3F2F81248B5BC243143A4FB6B0591DD640F660039A366A043B4F0E7189E364281EC5835C4134586829C19CA96613C83687
Malicious:	false
Preview:	\|...,..Y....=C..[.t..]...'..6,.@.p.6.Y.Z..?gbm.,...4...Z.............!..L.!This program cannot be run in DOS mode....$.......... .vqs.vqs.vqs...s.vqs...s.vqs..pr.vqs..tr.vqs..ur.vqs..rr.vqs`.f....k.{...c...fB+..%.j.@].......(.....9I.....h..E.N.)....Rich.vqs........PE..d...{.:a.........." .....<!.................................................@L.....1.L...`A................1.../..Y.........t..]....{}-..4.^.Y.Z...8gbm.e.b.6..D..T...`K.....l.D.8...................H.@.(.....A.8............P!.....dFD. ....................text....:!......<!................. ..`..r.[..Y..,...3...S......'..6,.@.p.v.Y.t....?gb..,...\|...Z.................@....pdata..l.....I.......H.............@..@.didat.......0K.......J.............@..._RDATA..0....@K.......K.........1...o....x......t....../..>g.@.p.6.Y.Z..?g"C.Iwa.4..rZ...........K.............@..B........................................................................................................1.../..Y.........t..]...'..6,.@.p.6.Y.

C:\Program Files\Microsoft Office\root\Office16\GKExcel.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	5384850
Entropy (8bit):	7.057783572700995
Encrypted:	false
SSDEEP:	98304:ZasSBtVmNPakCy37lQTJV4ANYFosBOhtOpl:RS1mwHg7lsJVGBQtOpl
MD5:	CBA66F4A58D29A54E77678CB8F5BBE75
SHA1:	6F716DFE4E338B59D987FE2CF23017F01A14DFAF
SHA-256:	E68822340F1A8E1B2FEA110C693DEF2E482FBA72E215EF679D27C32FF7440AF6
SHA-512:	09788A277F49F297E3BB56FEFC5BA9045C36E5A30724D28A29D2DDE9C3B946993DCF714568D794E07D2E2EF3DE5EAF2CB4B73E91DE396F5F791B038301485DCB
Malicious:	false
Preview:	K.b.x.........n..s.9LX..Xjb...._..T..D....i.Q.........?TN...........!..L.!This program cannot be run in DOS mode....$......._.................o.....w.......w.......w.......w...............}..i.3K.d...w[~...f{....%.a..k...Ze.6e........:U@.#&;A.\<]..i........PE..d......a.........." ....."8.........`........................................0R.....6.R...`A............................{.....k#..<...9L...XFc.......P..D......Q.Y.....nT.....D.8.....................8.(....A.8............@8..............................text...t 8......"8................. ..`.rdata...?..{......{...n..s.9L...Xb..'.>..T......y.Q.W...:....?TF.......@....pdata..p.....O.......N.............@..@.rsrc...l.....Q.......P.............@..@.reloc........Q.......P.............@..B....{.....{#..n..s.9L...Xjb...._..T..D....i.Q.........?TF.......................................................................................................................................{.....{#..n..s.9L...Xjb...._..T..

C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	3008642
Entropy (8bit):	7.060983690563671
Encrypted:	false
SSDEEP:	49152:xjIi1lwjXuLNYzBEGtCnPPjinA+nUP7IUpg:OCGtCnYUP7a
MD5:	3DE46746481B72950160E15514011065
SHA1:	C71B7C3644F316FF475B697E1BB03DCBA3474CF9
SHA-256:	83EC80F47CAE235442583153727F4B0611593E6A5D8369BD44C732D78A12716A
SHA-512:	1C3E639779DA3B2213862C4C5D43252BF77FC2504F7893E7F001DBECC6EE629C3D43AC69B2B66AB5D3AE738EE77B456611CBB66145C0FD33AD4DDD68F771B6FF
Malicious:	false
Preview:	.g.7.%d2g^...K......:......\|yH...,q..b..J.....,....=.hk..b........!..L.!This program cannot be run in DOS mode....$............U..U..U..`U..U...T..U...T..U...T..U...T..U...T..U..c[..g..lZ=8.Z!U.ms.........H.x..27..FW.\b....]9.:...QYu7........PE..d...P..a.........." ................ ~........................................-...........`A.........................-^7.%d2c^.......L......t?..}yH...,...b..f.......>...=.h+..^.b..%.8....................G..(.....#.8............................................text...8........................... ..`.rdata..\|+R7..z2cF........:......\|y...X...b..K.............hk..b....@....pdata..$/....,..0....+.............@..@.rsrc........0-.......-.............@..@.reloc.......@-.......-.............@..B.=^7.%d2c^........:.......\|yH...,q..b..J.....,....=.hk..b.................................................................................................................................=^7.%d2c^........:.......\|yH...,q..b

C:\Program Files\Microsoft Office\root\Office16\GKWord.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	3850906
Entropy (8bit):	7.040246151324195
Encrypted:	false
SSDEEP:	49152:q7xN0M5BqBu+8rmjWsaVSQkYmUqc6F7lg82ivxIw:qtaM5BYF/WsaVSQk/PXpyUxB
MD5:	CBCA618F49B6DEFBEE7F2A1C524D009D
SHA1:	ABFD20C5108DC41AD8804BC7CFB8C4308DC1DDAB
SHA-256:	A9C3350D8C4D145C25BB38365DF7593DC85E90CD3955CF7A54F4335B861C0600
SHA-512:	3E8F660D40E6D9A517BA7A25984D8E09EB70AA1D6671DD8E9AEF4A844B312A8B9578BCBAA1C1D0777E60AE32C4AAD09E79FC8C7E28952D749D829850AEA5F6D6
Malicious:	false
Preview:	YR\|m.;t...z.......%..XU..1B.I.@D:.FeSQ..kw&i..U!3...~P\|=.k..X..........!..L.!This program cannot be run in DOS mode....$........JG.+)..+)..+)..S...+).._(..+).._,..+).._-..+).._..+).{Y-..+).oQ....]...Rf.\|.y.@.bYs\|K....c..4e=..xxi^4...8..Ql.D.Uy.os...r..................PE..d......a.........." ......'..v................................................:.....@;;...`A...................m.;t...z..W...%..XU..I.BpI.@hH$FIRQ...N&...U!S..8.Q\|=fQ.\|.....:.......0.8...................8.'.(.......8............ '..............................text.....'.......'................. ..`:z..~Zt.h"u..w..*..^r..1B.I.@D:.F%SQ....R...U.H....f\|=lj................@....pdata..$....`8......08.............@..@.rsrc...l.....9.......9.............@..@.reloc........:.......9............mJ;t..z..W...%..XU..1B.I.@D:.FeSQ..kw&i..U!3...~P\|=.k..Y.....................................................................................................................................m.;t...z..W...%..XU..1B.I.@D:.FeSQ.

C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	4575386
Entropy (8bit):	7.104336181603219
Encrypted:	false
SSDEEP:	98304:IyPQcFWCx137tEf4vR2RvnkXBdSkyerFBbF4HxRZu:AUDZ0vnkOkyegx6
MD5:	AC27C3707CBBDC37C21C504CC56D031F
SHA1:	70B0B9DE8B017A7CC1A6B6DF29C0EF6184EE7F4B
SHA-256:	87A1CCF217777D1A536EACAD2E06EF6DD245F0F63A7AB21B24F51BC82B8A3D30
SHA-512:	26AF7E5DCD8E5A79493D4E3D07E3F7532612112DE1380F848AB94A3764FDDC6BBE9CF93515ED313DF23F106E89BF2D950533DC606F6B1A25304BB2DB827B6DC0
Malicious:	false
Preview:	_.!...}{Q....R..m...d(.;P.Y@...V..B,"S..1X.......@.................!..L.!This program cannot be run in DOS mode....$...........X.t.X.t.X.t.Q...H.t.4.u.^.t.4.p.R.t.4.w.\.t..p.S.t..u.U.t.Jr.f....aJwRs#.P<.IOQv..A.-3>.c4gL!<E.X..`....xG.y...H........PE..d....[<a.........."......d8.. .......(8........@..............................V.......F...`.......................................}{U........\.d(....-(......=-"S..18Q... .H...t~......................_=.(...P.8.8.............8.....<a=......................text....b8......d8................. ..`.rdata........8..V...qE{U......m.H.dh._1.8@../wD..r."S..1X.3.....@.........=.pdata........R......"A.............@..@.didat........S.......B.............@....rdata........S.......B.............@....c2r...........{U........m...d(.;P.Y@....%.zB,"'..1X._..z..@x............@....reloc...`...0V..b...(E.............@..B......................................................................................}{U......m...d(.;P.Y@...V..B,"

C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1080
Entropy (8bit):	7.14760244649161
Encrypted:	false
SSDEEP:	24:zmgdggB3J42XHbseN9p9j9RvTK+DQXbhdP7TwJ1Ex:zmgdggj42Lr1JLvTK+DQrhdIJy
MD5:	BA31F3052B0B7900646405E09CAD4650
SHA1:	A22689C3BBDD5DF404383221EF46F798B6211C76
SHA-256:	93D5B10421386EF3BE256A8C87A525FA929058A0C3E8EDE545FB87EE0A9BA661
SHA-512:	F772082BB67B83317945913F5CF2E3DB2C42A0DC4BD4C6BD61F0B5F5A3ED81C501F285F69D12080FF9F8C962289ADF2406317301BD40C78B565C77B6F6FB3522
Malicious:	false
Preview:	_..t...5%k.t.....a2=..........3....0.kP.J[..#...Q.....ZT._..t....5k..c....&..2.g..pY).Z;..2.d.....9J......-...z.ZT._..t....5k.t.r.T%...o>I8......2....0....J[..T...&.....ZTP........5k..c.r..!".n....`....L......#...nZF.[.X....d..x .RTW.U.0.Xf&8.$..r.\!".n....e....L......#...n..J[.X....d..x ..ZTW.U.0.Xf&8.$.r.\!".n....e....L......#...n..J[.X.W..d..x ..ZTW.Q.0.Xf&8.$.r.j.n....e....L...0..#...n..J[..#..d..x ..ZTW...t.Xf&8.$.r...n....e....L..2...#.._3..J[..#..d..(..ZT....t.\f&5k.t.r.$..j...........2...kC..R.J[..l#....e.....ZT._..t....5k.t.r....a2..........2....0..R.J[..#...Q.....Z._.b.t....5t.t....&.a1...0...Z.......P0.kR.E..........u..U................p...p...p...p...p...p...x...\|...~..................jWd....}..C...".4...W.Yk@...<.Y.f+L....2......>....^..xP....&...M.2.\|..O@......2........F.2.]]........2<.2.f.z...F{...\|......\..+....1W.<8..Lb..\|.v.lXw.s.Y.q}..F+.Sy.y.V..#"...>......G..T.]....T..k.........................

C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	7.683262811862729
Encrypted:	false
SSDEEP:	48:mpeyigE/0GpjrSJvJdBtJNM+WZl1TBcJT6LY:c6sGJofJNM+wlc59
MD5:	167177569895CD5D1C68FF9665BD2A1E
SHA1:	4633F64E7F43234B3072245748522ACE7C08120D
SHA-256:	639AA9670583BE6E70B9BD85447B2022758663A635B6F0AE600A7737857B2B7C
SHA-512:	64F1EA634B5A85074411C380C12CAE0ED48C4B2BF9B7EF8B7864A69628EDE55018273CE879B202E3EE86AACA9B15D25162105C4AA90D41D17D3D6CA835CCC4B6
Malicious:	false
Preview:	l8..G:.a..^}xL.$.3.L.f....4.....Z.. >jy.sNu.QI.....1........"...NA.b.`..H2)P.$.bJ..)...-/..P.#..u&+y.<V ..K....'..PK....l.....FO....TFeM.8.e.^.....<4...<.2..ky'h.kiu.SR.....1..\V....`.....H`.}..XjxV.8.cJ..0...+`.....o..%>-x.bH3.I_.....=........"...NA...h..R{r..@.-M..'....!3..U.a..~hjM.sPy..B....$..ZW...m..._Y1,.b..VceV.h.cGX.'...c0..Y.a..5.%g.sS\|.K.]...]..PZ....(...%$q~.h..^\|.@...x_..!....DT....k..}o>o.WXt.HR...."...U...l...eC.-.h._.zbd.).bZ_."...pa..G.k..}x.r.qUe.RH3....j.<0....4..._Y.&....RcnB.9..#k.x....<4...;...ln?y.[Nw..+u...9..AP...%..AA.1./..U5xF./.pZO.-...()..[.m..h}>c.{Lx.D.....Y.<....8...EB.\|...t23*....t.+.d...n4..U.z..8}:z.{Cp.TI....$..A.......CZ.b.-.P...,.C.b\..+.....}.....=.+$(3.?.u...K..l..Q.....a...J.K#./.A.\|~U.%.eL.......Ga...b.g..Qxj\|.~Ut.TH....1..AQ....!...MY.-.-..K.dW.9.F@..+.....((.._.`..qh3'.,-..4/C....;..P]...5....LJ$.5.N.:8G.g.%.S.&....xd.....8.. ah4.=Sd.MI......?0...\|...DD.b.i..Zc~@.#.u@..0...+}..Z.m..qs$

C:\Program Files\Microsoft Office\root\Office16\HeaderPatterns.xml

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	29444
Entropy (8bit):	6.547640270495945
Encrypted:	false
SSDEEP:	768:Y2sss0fhRLr++ND0dwEp5PKbAEJyz5X/AY44E:0slfhZ+VumPKEVzB/AY44E
MD5:	D0329BCF968D864D07C82B90F31C6C38
SHA1:	717EDED7521C111A46886D0348DA627EFA563260
SHA-256:	454819E11756626B840754A85AD035A14555D50ED073F4A05C91FD42FB5E4F6D
SHA-512:	2B9A5FC6BC9C3930F9D50709A104951098FCE1EF804608BFD22192C3BFFD368637448DEAA4E40D16CBFC0A00CA48CDA347FBF55230FF315E1D94F00F7D047252
Malicious:	false
Preview:	...m..\|M.-..-...#9O/.c`.B....1.!..z.Cn.."..7..JdI.IL$e.&.%eaderName="Van" type="from" /><pattern headerName="Gestuur" type="date" /><pattern headerName="Aan" type="to" /><pattern headerNX..=].k.@..&..n+M ..pn._.....x]qyC+..->.4.. ......M.rs..(ct" /><pattern headerName="Wanneer" type="when" /><pattern headerName="Waar" type="where" /><pattern capturePattern=".\s[..E_..V[Jv..\|.'-O/.ob7E......<.=.R'.Rj..p..'..i;..MJ>=.......\s[...]\s(.?)\s$" dateIndex="1" /><pattern capturePattern="..\s[...]\s(.?)\s$" toIndex="1" /><pX..e..K....1...y}.}.."......._K:.....3z\|[U~...!F..z..aV4e.u.\|" /><pattern capturePattern="..\s[...]\s(.?)\s$" ccIndex="1" /><pattern capturePattern="... ...\s[..m...zWt.t..\|...)+M\|.jj._....!.wEW#L. OA ... ..Z;..]J5P.<.(rn="...\s[...]\s.?\s$" subjectPattern="true" /><pattern capturePattern="..\s[...]\s(.?)\s*$" whenIn]..=].(.O`.."....gMl.tz.N....!....

C:\Program Files\Microsoft Office\root\Office16\Httpproxy.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	24754
Entropy (8bit):	7.0357065351490915
Encrypted:	false
SSDEEP:	384:fdB573BP91G3ONNPhpx+Fi686ji+3h7oRqY4bEQi:fL5jBVIolDxQi686u4aqjEx
MD5:	834EBE74A7EF2E182EDF23A9AF5484D3
SHA1:	089DE7C4AB08B627935AE1F6B8653520077D111C
SHA-256:	1371FA5C1524FA02E6D2C816BBF37EDD92FBD4187EF2C7047694DB37607C66C4
SHA-512:	64A22BD67516717AAB32BB9576BB86FCDEAD420F5A5D8417A8F5EB2A37201FA11004C3DA4F1A2054DC881E108D28281526BFBE12BBF0FA25F3910B352A3C2089
Malicious:	false
Preview:	]......5E...9.......N......G.R....6..........."..C./._."0\.........!..L.!This program cannot be run in DOS mode....$.......u...1.x.1.x.1.x.8..5.x.c.}.!.x.c.\|.9.x.c.{.3.x.c.y.5.x.^.\|.3.x.N(...z..p6.S.Tv....\|'y.E.......~[...C.*.5.+q...J.;k/._."1\.PE..d......_.........." .........$............................................................`...................................l....5a...Z...........e.@F.R....4.........B."..C.._.R1\..........................4...............0...............................text............................... ..`.rdata.......0....l....5A.......'........q...G.R...f..........."..C./._.b1\..pdata..\|....`.......4..............@..@.rsrc........p.......8..............@..@.reloc..<............:..............@..B..........l....5A.......'...N......G.R....6..........."..C./._."1\...................................................................................................................................l....5A.......'...N......G.R....6..

C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	393882
Entropy (8bit):	7.071385850720593
Encrypted:	false
SSDEEP:	6144:b1Wn9jGmzy74FgEN3C5Dw1l/n2zt0xzXAYCrkvw5vpQU60IpWZErSVvz:pWnp0D0l/Qt0xLwkY5h+cOrSVvz
MD5:	7C6F3D521DFA31B635779AE7817D9985
SHA1:	361A1FED269F94594EC611539415AE288211B10A
SHA-256:	F535407A8E6C92868DA6384712E18EC5B671D34E1ED85BC5CFA759E352870513
SHA-512:	077D8BE9D8609C90BA46DC484380544549931E16B37A7BBC5D51EDA7BC608C926C6FB8C135B7B4A19B753CAF9060EF2B96E8E226CCD3E33C876F6C814E7FD233
Malicious:	false
Preview:	..^Wr.5q.a.n.'...J.w5w'. .\.....@.e.0].].M....@. x./....?L/M.........!..L.!This program cannot be run in DOS mode....$.........=..S..S..S.7.P..S.7.V.u.S..W...S..P..S..V..S.7.W...S.....ef.f...T..IS.G..$.g.../.d1..-.fc.....L8..\|.q./......W...[................PE..d....6.`.........." .................L....................................................`A.................B.Wq.5q.q.n....u.J.g5w'..\....).D...0]..Mq...@`%xj...j.?<kM.........\|...8...................P...(...Pv..8...............P............................text............................... ..`.0.6..5q.&.n.(..u.K.w.t'[ .\.....@.%.0..9.9...X. x.o....?\.H.............@....pdata...&.......(...f..............@..@.didat..H...........................@..._RDATA...........................B.W1.51....u....J.w.r'[>.\.0....@.e.0].].M..]n.E..L..C..?\.H.....................@..B.........................................................................................................B.Wq.5q.a.n....u.J.w5w'[ .\.....@.e.0]

C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	SysEx File -
Category:	dropped
Size (bytes):	692002
Entropy (8bit):	7.1166269561235485
Encrypted:	false
SSDEEP:	12288:fp6WfQyU3/IHEklUiticNx5KGZd0+f2h9CmFRgr0u:fMyU3/IHEklUWicNxgGZ2+f2hQRF
MD5:	888502F73C8701D78A404E8C04ADB375
SHA1:	2EE91BF72054A0A3CB0AC33079626B8062303CDC
SHA-256:	C7FF6723E155DEA8AA3860A7DB8178D24AA29D2356420977F65E3404122AA8DD
SHA-512:	B3041588BA5FDD17C5F831C76FF5CA355E085669EECC5B7837098CB8D4B0FCD9DFBBA3D12A406DC6F52F283DB7FBBEBF0E76DEAAAB3D017F56DE2121DBC59441
Malicious:	false
Preview:	.].w.G.@.1..5.....x......L...\|...F..~..%....e.SV0.Vd..>.......>........!..L.!This program cannot be run in DOS mode....$...........M.\|.M.\|.M.\|.D..._.\|.+...O.\|.!.}.K.\|.!.x.G.\|.!...O.\|....O.\|......\...............q...q...j.E.x.;.ns.......3..*.j.....~.L.\|.RichM.\|.................PE..d....Z<a.........."..................q.........@..........................................`....w.G.@.!...+..O.h.....L\...\|...F..n..%....e.SV..V\|..>.S..c..>.P..lE...H...E.......$..x...8...................@...(.......8...............`............................text...{..................w.G.@.1...+.ap.f...A........~".%....e.SV0.V$..~.......><........B..................@....pdata..lE...P...F..................@..@.didat..`...........................@....c2r....P..........w.].@.1...+..O.x.....b>..\|..[B..~z.%....y.SV0.Vd..>......~.reloc...$.......&..."..............@..B...........................................................................................w.G.@.1...+..O.x.....LL...\|...F..~..

C:\Program Files\Microsoft Office\root\Office16\INKCOMMENT.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	166530
Entropy (8bit):	7.0193957139785255
Encrypted:	false
SSDEEP:	3072:ef36+7Q/Bj7Sbi4pKnb8xA1AsOJE0M+k6fueLfOH/:Hz/B/hAKnb8xsmEajfOf
MD5:	FBB53592E972D58BFBB35714602EC2CE
SHA1:	3678B804B0CAA64E578D8954B34E24C07110B310
SHA-256:	9171BEC95E0DD31B6975AED6844B61884F56F543045D01D47FE410D2A37795F4
SHA-512:	210D8AD919B1662E2957391BC469C54D10B61F831F3358F6D687DF7B413CB2F43052CCBB14A4A2B795EE97ED30C617BD4975ACE62F7E56A90A817A335C260022
Malicious:	false
Preview:	.L.m0.~..+..p7..vM..7..u. .s"M...~.F\.h..uN...bq..9.>/e...\|..........!..L.!This program cannot be run in DOS mode....$........................R.............................................&.....Zl.`#...x...>.>T...+o..[.<&.......\..@p..'7..*.9.!...;Rich....................PE..d......a.........." .....V...........D...............................................k....`A..........v.n0.z..+Q.p7..vM..7.Bu. ..s"q.....F\.....O....s.. .>/%..ah...D..HE..........X...8.......................(.......8............p..........@....................text...]U.......V................v.N0..T..J%.p7pwvM.6.B.. ..r"M...~.F\.h..5N......f9.>.u...]......................@....pdata..`....@......................@..@.didat.......`......................@....rsrc........p............v.n0.z..+..pw4..!..7..~. .%q"M...~.D\.h..uN...bq.G9.\|/e...}....................................................................................................................................v.n0.z..+Q.p7..vM..7.Bu. .s"M...~.F\

C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	138362
Entropy (8bit):	7.001690413661381
Encrypted:	false
SSDEEP:	3072:S6YhbxSMK4Iv98zVT+LoQJBVjZGVEMSlATppIT:5Y1rIv9o1+LoQJj9GVEMQA7IT
MD5:	08F48AF75762FB8B116D829A8851AF1C
SHA1:	7DAB88A364E8A7585F2FC4D2A1A43E12B6420047
SHA-256:	EC2DCD1DD1CA9D94C42D89143EF50BDC222D56BA7C83691465125742608B9BB1
SHA-512:	7EDC1949FD79BA6DA1C9DCE40BBCF125A458C78100EAB4FC327728FE6DB45923951E6BE8B729E700AE7D29BDD0F6EBF3EB5633FD67A12D36D7263B9EE438B06A
Malicious:	false
Preview:	......!Q.(...d..+.....n....<.8..g.,....tWB...z.6.^$...j&.!.........!..L.!This program cannot be run in DOS mode....$.........g....@...@...@.@...@...A...@...A...@...A...@...A...@9..A...@H....(.ag7!..m..U.=...+...x.R......K,<4......wX.-..m.N.z(O................PE..d....>.`.........." ................p........................................ ......G.....`A.....................!U.(..Wd..+.....n....M=.8l.f.....o.t."....6.U$...k&..!..........U..8....................8..(.......8...............8............................text...N........................... ..`.....!..(..Ge..}...&.n.....<.8..g.l.......6B..]o.6..%...j&.. .............@....pdata..4............d..............@..@.rsrc....`.......b...p..............@..@.reloc...............................cU.(..Wd..+.....n.....<.8..g.,....tWB...z.6.^$...j&..!......................................................................................................................................!U.(..Wd..+.....n.....<.8..g.,...

C:\Program Files\Microsoft Office\root\Office16\IVY.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	2276954
Entropy (8bit):	7.147695390090667
Encrypted:	false
SSDEEP:	49152:1OC1Wp31l5MH2lcaknLqMqLI/FGvMbmgBgxk1rf:3Aplwt9KWZf
MD5:	51FA3169F11D6237EA8477FD7734D4F2
SHA1:	BE54AA0FA6C0312B384A6AA01461386BDC3C3279
SHA-256:	DEEE0EFC2EE8822AF38C011EE872C74C8B9687C9AB63A1126C204E4B18BA03B4
SHA-512:	4CCF775223F4C41557070CC4C4BD7F460AB245E3EFAE752CBCDBF93B138014B8EABE10D32964B85AC4082D1ACF5CD4C109342056C89B78E0370233E66E6A3424
Malicious:	false
Preview:	.pA....z.....:...h$qQ..........).Eo....f..D..O.,..K.z..ZGR"n.s.j........!..L.!This program cannot be run in DOS mode....$..........O.........N......N......N......N.......8.............{.x.)f.wa.C.V.K.l.Oh..B.Ja;5..S..C.zZD.E.;0.o(..9FGR"n.r.j........PE..d.....`.........." .........................................................."......+#...`.........................]:....z....W....S8q........B..).EM.3..f.=d.Ir.,.~i.ZF.ZGB.n..j....8....................!..(...p ..0...................XU.......................text............................... ..`.rdata..d.....z....G...h$qQ........i.!..z..fi.E....,..J.z..ZGR"n.r.j....@....pdata...=.... ..>.... .............@..@.rsrc...(.....".......!.............@..@.reloc..p.....".......!.............@..B]....z....G....h$qQ..........).Eo....f..D..O.,..K.z..ZGR"n.r.j................................................................................................................................]*....z....G....h$qQ..........).Eo....f

C:\Program Files\Microsoft Office\root\Office16\InstallerMainShell.tlb

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	3190
Entropy (8bit):	7.372746752377387
Encrypted:	false
SSDEEP:	48:2z5D7GbSYTGQMRTFTxTn+fD/zilgqCPviT+V2cCrP15Z7XsbjfDHsLBFK8WrSUui:7eYCzTF2Li/DxzsB5
MD5:	45A28B7BEDFD2EBFA65C33FCDABC2958
SHA1:	D755AEA9BB4EE662EA85D8CF77709AAC075851CC
SHA-256:	0CC22979010511215DA548A7BA5CF20BB4D43C1D81864833C5493DD5CA28F03F
SHA-512:	6C61965FDC3ECECFCF4AD7925A048C3D23022EA738573427B682FDD0168FC3B1889C4A1F960BB31ABEE5B1D2E9759DD70709F62E9324498A7BDBCEF9F28CAF06
Malicious:	false
Preview:	......*.y..<....F..j....Y\l..F.$]..].~%........>c>]U..J..Pl...YQ.8.+..y.......F..j...Y.l..n/$]H.]..$...>....>cfXU..J..Pl...YQ..+.y.......F..n....Y...0M.$]..]..%...>....>cv_U.wJ..Pl...YQ..+.{.......F..l....Y...0M.$]..]..%...>....>c&UU..J..Pl...YQ..H.8.y.......F..c...Y...0M.$]..].Z%...>....>c.@.J..Pl...YQ..H.8.y.......F..(....Y\l..B.$]..].~%........>c.\U..J....K..YQ...+.y..4....H.o.j....Y...0@.$]..].~%........>c.@....{.K..YQ...+.y..5....F..j....Y\l..B.$]d.].~$..K.....>c.\U..J....K.w..&....y..4....E..j..>.~......$$]..].~%........>c.\U..J....K..YQ...+.Xy..5...F..j...Y\l..B.$].3...%........>c.\V..J..Pl....R..+.y..5....F..j....Y\l..B.$]..].~%........>c.]U..J....K..YQ...+.g...4....F..j....Y\l......]..s..>..B+...@x.dyPl..w..&.H.8g........H.oM.0!>.~..l.....3....s.....B+...\U.x.dyPl..w..&P.+.y.......H.oM.0!..Y...0:.$].........9.U..@x.dy.)<.....m+.`........H.o.....PH....Y...3..~%..k{\|....r..U..=.oPl..w..&yG2y..._.......=.j..>.~.m.a.`<.....7

C:\Program Files\Microsoft Office\root\Office16\Interceptor.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	530690
Entropy (8bit):	6.789885267009764
Encrypted:	false
SSDEEP:	6144:S4DZal2etxXpIADB7LufiSCgf+3bTdIsVq7ZteHMM0SSC06Dm6m9h9mBqYLlzlf4:xVal9/F7LTRgATdIsVGTM0ljz/oM
MD5:	E9296D60A0D78131A51CBF2433BBA660
SHA1:	1FA89F088AE42309306684897E01CE2C9ECE67DA
SHA-256:	688420AF9754F68D2B4E3966E120D074E352AC09F2A8A33F56CD643CA8C0F719
SHA-512:	B9F3D1BE6A8F529D06AF338BD42CBE7132701CDD786CF8409525C1F22FD1B152F63E1967D36431DB0D5A0F00EEF50BDCFDCAECB8054101F73BB8C050CFA7DEC5
Malicious:	false
Preview:	..!7l......;.}M-..j`..I.$.=.........:S!...MH..g.[J}..X...=...C........!..L.!This program cannot be run in DOS mode....$..........X............(.......(...W...........................(..........+..#g_.61Fv.p...h._....7.&.b.,..X.....O...)A...S...7..8HRich............................PE..d......a.........." .........D...............................................@......F.....`A.6!4l.......}.-..j`....$.=.........:S.F...H....]J-..X...=o..C.....1.......E......\ ......8.......................(...pc..8...................l...@....................text....................&!4l.....6..._......Tz'.=I........9S!...MH..g.[J=.....jIN..C.A...P...@...4..............@....pdata...1.......2...t..............@..@.didat..............................@..._RDATA...........&!4........}.-..`.C'.Wh^...E.....2S!...M..g.[J}..X...=o....reloc..\ ......."..................@..B.........................................................................................&!4l.......}.-..j`....$.=.........:S

C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	48302
Entropy (8bit):	5.832811875969108
Encrypted:	false
SSDEEP:	768:8MQhfizqyf//h5nk8N09O2pt6Wo8gUDZkR6lMot7NgqgacT:8DhQqyf//h1tKO2yW2UDZ8ctjsacT
MD5:	D0855F46BDD38317F7FA30FE76E0F2FB
SHA1:	AAC52BEFB8D238EEF9378DC32A11B3A1A7AC7665
SHA-256:	9794234BEF9CE54F2A272DEE853E5A4F32E934836B0E62352A00BF160BEC54DA
SHA-512:	76189D9655551B1985932279DD2EE289A863FEE5D9640D3204CB71E181B221B1603588DB1C568B319C4564E44B933B6C8FA731E68E198E58FE5137B1E3B95124
Malicious:	false
Preview:	..EvR~..<11.D.....{.e.1....?.N.w.I...m^rPQ.N..e.8.V....i..T.+...... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(..._E.".t..h:1.......{...1..?.C.w.D...m^.^Q..e.5.V....m..TY.......0...........\.......$...........P...........\|.......D...........p.......8...........d.......,...........X....... ............R.".c..(/1.5...8.{.f.1....?.n.w.i..T.m^FqQ...e<..V.0....T.....#...#..T$...$...%...%...%..H&...&.......'..........,,...............-...............................)..............d*...........O."hS..<31.#....{...1....?L...lI..H.m^.PQ.M%..:.V.u.....T.+.......................m..T...........@n..$...........................................!!..dn......................................,...P~.. 11.M....7.g&.1....?L...cI...m^....N..e.:.VQ...I..T................................................................................................!B..,o...............................O."P~......M.....{.&.1..FE..N.wcI..{T..

C:\Program Files\Microsoft Office\root\Office16\JitV.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	269466
Entropy (8bit):	7.094712248134151
Encrypted:	false
SSDEEP:	6144:kxh8GekfySpF9NUzbC4r/P7TS00l1rFIIFIR9jEw6Vc5si:kxh8GekfySz9ezb50lB+I6o29
MD5:	A519900DDED7791C5CDE8BAC5D6245DA
SHA1:	7E0B877D7964A70729E0F2839734D01AA3EC7C5E
SHA-256:	7A53ADB5045DA14B6E07337D630A322562A4241561CD1C7AA857BBE784AE6357
SHA-512:	7169728C542C2FE509D0AE5813DFEEE049E58E57FDD34164971ADB76AE9AF092D295949456DD00C4BCBAFDCBF8AC4F26DD237D7CF94A4E10266A24C7B33FC64C
Malicious:	false
Preview:	..b.].......5.9#..pO..C...H.ib.#)/_.:.s..V......N...&#TFa.Q.H.........!..L.!This program cannot be run in DOS mode....$.....................j......j......j.........................0U\|}.p..(.QD.e..._V..)x../Q....:B..>.".....i\|....`Y.../...B.........................PE..d......a.........." .....<...................................................0...........`A........Z...^.........9...pO..C...H.ib..a/..:..@.V......J...&#T.b...H.....`E... ..d....W..8...................p>..(.......8............P.. ............................text....;.......<..............Z...~.w.......9..pO..C...H.)`.#)/_.:.s..V..../..&#Hna.ImK......l..............@....pdata...............~..............@..@_RDATA..............................@..@.detourc.!......."......Z...^.........y....,..C...H.yf.#,)/_Q9.s..V......N...&cz4..&.H.d.... ......................@..B................................................................................................Z...^.........9...pO..C...H.ib.#)/_.:.

C:\Program Files\Microsoft Office\root\Office16\MANIFEST.XML

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	3522
Entropy (8bit):	7.8340218442539165
Encrypted:	false
SSDEEP:	48:PHt9FeZu3ulBGi2+LcwZsk0pNSK62kFO3b08SKu1T24ZD2DKsdnh5+DbvZ0qC9d:PN9FeIEwiHLxK6tO3ba/BahADCqO
MD5:	E1101F371D03B6981BC44A59CC937EBF
SHA1:	EDD68647A9A13629B1281E72A9720E2D4A2330F0
SHA-256:	712798D99FF7522B55899B76233C5874F3BBE7175EA2A24ED429734DC222BB10
SHA-512:	E2FAA0631C162AF0D89BFEFD9EF64E6A229B17619CCE96ACCCE98622885A788449ABE0296FF42897F163F591D1FA0B1742350F7BE3DDEB0F286D679F14165129
Malicious:	false
Preview:	.'!..u@...dy..^.u.@!.....K>}..q....O....>Z.`..g..No..q..X'd.@.Du<Z. D...n~....v..b......:/..J....Ksh..#H.%.`.9I~.!R.._tc....5t..=S... {....(..u......C?)........h..<G.`..1.p\t. j..B.n...JvdE.{...\94....?..u.....Kdb.......!SP.. @.#..0.`.+.e<.^+mHB.Lt<].z....Xe....9..r...=..V24.y.....ir..1Z. ..h.5\o.-m..."j...D.<Z.0X../6..q.g..r.....L:!.J.....sb...G."..u.~kt. s..Xl+...Vq6..'Y...04......i....@74........i7..5O....d..Wo.;m..Bns...V"7..h....},....3..`...J/........\|o..\|^./..u.>\r.;m...~)Km.,$7..o...=^P....2..e...N..c...(....@ P.. @.#../.l.u.d$..^=b...(.P[.&...~f...:..r...h..Kq..L....?{k..F.,..<..a6..<....+"..Lh<..4...<,...7..O..._..,P\|.......{...>L....`.5.9..3...pO...Iy G.4[..@o....a..r......H<~..,....K^o..?H....d..@x.9{..i.& 3..\0..9W..<l{..O.g..r.....I89..H....x&h.im.>..`..Nv.uR..M"nHB.k5.4.kr...aw..2.6.B5.......).I.....$...o..>..E.#_w.,P..I=5xj..vV..S...df...(.o.........%.W.....:J..2E.p.O..\|9..{..^'{...K8h[.;E..6he..../..o...h..K*q..@.....si

C:\Program Files\Microsoft Office\root\Office16\MAPIPH.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	473834
Entropy (8bit):	7.0186624788195395
Encrypted:	false
SSDEEP:	6144:l6/1YMboRlIZRxwoArJgkOgGD7wTWOFb5ItgmOXCsruqTfzHQT6PsXwXymRN4wtP:ligSRfAriwTWOrIt5OXnruqW6xymv4C
MD5:	81FBCB26EA488039C0E77EBCCE526BC7
SHA1:	74D6031D2A28CFF948D2F5811D5F859A26B87997
SHA-256:	B35DD3E6E504851213D7C578C7396AB32ABBD8AF187D317B6EABF17BA6EEBDCE
SHA-512:	3122ED935761870CD171E9D98F372BD2B37CC0074143761E3EF7F3C107BFF5684C685F2FAD5A5FED402FFCD0C4AC86BFBED6A004A38C5BEFC012FF5741732ACD
Malicious:	false
Preview:	...f%.;...N.u...(..)..U.>.>.K..h,...<...j(...}'f..$.'..I.0\|.........!..L.!This program cannot be run in DOS mode....$...........Y._Y._Y._P.:_M._?.T_[._5..^_._5..^Q._5..^[._5..^y._...8}.X#@...S.D. ....<....Je..c..rO ic.U(4\|.....9&...Sn.......^Z._...^5._..V_X._Y.>_X._...^X._RichY._................PE..d......a.........." .........X......`h........................yf&.;...N....r./..-...9.=.+..x,...<..j(...}7f..$.'..I.1\|.....................\|.... ...........3.......E...0..........8...................0...(...P...8...............8...d...@.............xf&.;....6......,..9....:.>.K..h,...<...j.....C...$.BI.I.x.....................@..@.data....S...p...P...T..............@....pdata...3.......4..................@..@.didat..h.................xf&.;...N....\.[..)...>.>.L..h,.%.<...j(...}'f..$....%.R\|......0......................@..B..................................................................................................xf&.;...N....r.(..)....>.>.K..h,...<

C:\Program Files\Microsoft Office\root\Office16\MAPISHELL.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	78146
Entropy (8bit):	7.1270119528831755
Encrypted:	false
SSDEEP:	1536:eEAplI5sBpA583Etdo48/OTTdshhTy/P5oSNOY1w:eL/Vp3Etdo4dTTdshE/P5LNk
MD5:	B0AB6298E2DAD256F0FD20A87D5AB43E
SHA1:	D91280FD0253BB51A84AD7A15AE56D43B2BCA27E
SHA-256:	5C120A52386C1C75BC762255B8290A5CADBCC0AC866ADF6D006969C08EABC5A9
SHA-512:	AC609035EEFC0193DA576037BF118B8A77D8E3E99F62576DCA7BD1B120D60D46766E466B4833F80F5EBF8665BB50F4545736C07C49BEECA9D1EECE689663830A
Malicious:	false
Preview:	W....JGS...s..'b...x..S..Wr_.NLh....}. .'.Gi.\|....\{Y.S.&.S_............!..L.!This program cannot be run in DOS mode....$.......!{..e...e...e...lb..o....n..a....n..m....n..g....h..f....h..d......d.P..Hns......{....p.M..BT....xn.........f..t...=..U....T.&f.n{.d....n..d...Riche...........................PE..d.....`.........." .........T...... .........................................i..NGS...sq.G# ..x..S..Gr_.NLh....}. .'.Gi.\|....\{I.S..GS_....0........ ...................F...0..........8.......................(... ...8...................x........................text...v#h..ZGS...sr.'b ..x..S..Wr_.NL.-..... ...Gi.....\{Y.S.&.S_9.......@..@.data...............................@....pdata..............................@..@.didat..............................@...4....JGS"..sr.&b ..x..S..Wr_.NLh....=. ...".t.....\{Y+R.&.S_9H..............@..B..................................................................................................................h..JGS...sr.'b ..x..S..Wr_.NLh....}. .

C:\Program Files\Microsoft Office\root\Office16\MIMEDIR.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	520858
Entropy (8bit):	7.061311964327996
Encrypted:	false
SSDEEP:	12288:47UsnOdahuOSVEuUVIzY+mkd68p0U6IIv7RBrE4wG5etKz:EoahuOSVEFIzvmkHp7XQ7RZE4wce+
MD5:	C401A16DAF7C1804444E5A13C6D60D05
SHA1:	3A6BF9451A381255ED7131FF4550729343A10D25
SHA-256:	77BEC84A545CBA476E49DA867F13C3D40B82B33F6AC21A0B25A1ADFBE4A3695E
SHA-512:	9DCE4CD3B1D66FE1F12934C6C21D50C5FFD9FAE74B1BB3E3A362285C7C7D9177552BEE2F85C556D8BD8B84E8EDDFF57FB8EA0C55426F64ED94DCE9F441685517
Malicious:	false
Preview:	..-.. t)l.`as.....8.EG..[.".%...a{....p.......;.K..V:..R............!..L.!This program cannot be run in DOS mode....$..........m.o.>.o.>.o.>...>.o.>..g>.o.>...?.o.>...?.o.>...?.o.>...?.o.>F>"..O..f..^Zdq.{....+.\@$..J...z.:e..N.........^..h.A.l..$....?.o.>Rich.o.>........PE..d......a.........." ................p...............................................Y{....`A.........5... t)h.pa.....8.EG.Y[.".%..)l}.M..p...@...a=.5.V:..R$.......`E......T...p)..8.......................(.......8...............H............................text............................%..6 tIF....j...8.C.Y.".....a{....p...@...Z...V7.R.........p..............@....pdata..4).........................@..@.didat..@...........................@....rsrc....................%... t)h.`a.....T.&G..V.".....o{..9.p.......;.....:..R.....................................................................................................................................%... t)h.`a.....8.EG.Y[.".%...a{....p

C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	DOS executable (COM, 0x8C-variant)
Category:	dropped
Size (bytes):	61082
Entropy (8bit):	6.656800745033343
Encrypted:	false
SSDEEP:	1536:Cde809qBBZMhOvnw6IdUnlLkXcBIqrzW40gxgKTzXPWtwOS:CdebqBBZMhOvw6IdUnlLkXcBIqrzW4/R
MD5:	177215B66F44244875E30B49DC0A2F53
SHA1:	FCD71767ED94F71C1CB42FFDCBD31AEB19305888
SHA-256:	85FF03DF9121793468FA03C3056FBCB7F0835280071FE0EB4D783558BCED261B
SHA-512:	20A0B57315E21931E59E7E29F548928D8EE4D6A28FC6EED44DA895CA5AF681CDB430526DE2F33AE47957A433F4F27E61EB51859CE0E593FC981060A4E4BAA543
Malicious:	false
Preview:	...0.......P.....+..W.r.d.O.Ww?/..z....H.fD.M......AR..Q..C.}%.........!..L.!This program cannot be run in DOS mode....$.......80i.\|Q..\|Q..\|Q..u)..xQ...%..~Q...%..uQ...%..tQ...%...Q..#..}Q..n.r...\...m..y...%*.u5..@..&8.J(.V......c..../...j=..VQ..C.\|%.PE..d......a.........." ................................................................r.....`A..................................t0.......P.W.......r.$sO.+s?/..z. ..H.fD.........T.....C.\|%.............................8............@..8............................text............................... ..`.orpc...;....0....t0.......P[W..M+..w.r...+.#.?/.ez.....HafD.W......AR..Q..C.\|%..data...............................@....pdata..............................@..@.rsrc...\|...........................@..@.reloc..Q.t0.......P[...M+..W.r.$.O..w?m..z....H.fD.M......AR..Q..C.\|%...................................................................................................................................t0.......P[W..M+..W.r.$.O.Ww?/..z....

C:\Program Files\Microsoft Office\root\Office16\MINSBROAMINGPROXY.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	61058
Entropy (8bit):	6.668124451738796
Encrypted:	false
SSDEEP:	1536:fCRE6cGfCk4ORIUilzknxY8fUvz3469/AUVBQ:KRbFfCk4ORIUilzknxY8fWz34IAUVy
MD5:	8A53DB5B477BCB2C65244099933BDA06
SHA1:	2F3DC67C1FE8B854CFD7E5E7E4990003B6BBF002
SHA-256:	BFD0656FFA691DB42DED50167C9CFF1C9B3573587AA433C36CB1C1F0A61D8246
SHA-512:	678252FF2D586891319AC59DD6EA837EC4D305BBC3A7EFB53EE145FA33B9FFE16FABC4EAF907D202A11665C4C8C7FF1D6CC4FE8E239E7E89B9273E7BE1F3093C
Malicious:	false
Preview:	.[.?.N. .=s...G}m....\|...g....b..j...:$Z...;..9.^...EJl....J=........!..L.!This program cannot be run in DOS mode....$.......80i.\|Q..\|Q..\|Q..u)..xQ...%..~Q...%..uQ...%..tQ...%...Q..#..}Q..l"C......lu2.@.q..Q.-.?.B.b..e.L..U..=....pF....7....M.....J=PE..d......a.........." ......................................................................`A..................................E?.N. .s.A.G}....r\|..S.....b..Pj.).:$Z ..s..9....=CJlX@...J=............................8............@..8............................text............................... ..`.orpc...;....0....E?.X. .=s...G}....\|..}....b...j...:$Z...;..9.^...EJl...J}.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..S.E?... .5s..UG}....\|..Sg....b^.j...:$Z...;..9.^...EJl....J=..................................................................................................................................E?.N. .=s...G}....\|..Sg....b..j...:$

C:\Program Files\Microsoft Office\root\Office16\MLCFG32.CPL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	157354
Entropy (8bit):	7.0005479681250256
Encrypted:	false
SSDEEP:	3072:NX5nLpmpBQrO+Fd0iayVm18NAGgkXHdI2LjYkD16AwcYmIDDnV:NpLpuQrm2ANkX9I2L3DoA+DJ
MD5:	980EE648205479111A25444F21ED6CE3
SHA1:	82CDD49C3FB6061788B7F965440D4F95D2C46FDA
SHA-256:	EB4367522E96B5FBEC0DA498BF1AF38ECF8DDDD2D102AAB6C1D43D1C67519ADE
SHA-512:	78BF3EDC6ABD005DB15CB009973CB22DEFB3CEF9C75FDE59306F674925B91B13E258E4BAB3665695C707ECCD234B326CAED90E56AB62B3FBF5DDA6ACFA094683
Malicious:	false
Preview:	..<...G.....k.P.p..M.\.'t.a....A7...j......QP.:n...6..3.............!..L.!This program cannot be run in DOS mode....$.........#.@.M[@.M[@.M[I..[N.M[&..[B.M[,.LZF.M[,.HZU.M[,.IZH.M[,.NZC.M[.P_f.}........&Z.P<......Kj........t......PA......5X;.m.)....I..OZA.M[Rich@.M[................PE..d...^^.`.........." .........................................................`......R.....`A...<...C....ok...p..M.\..'t.a....A'...^...}..QtN;n...6.v2.`F......\|.... ..pE...P..........8....................v..(...p:..8............0..P....y.......................text......................<...C....oka....,.\d.'t.Q...[.A7...j......QP.:nY..v..R.................................@....pdata..\|...........................@..@.didat..X...........................@....rsrc....Q.........<....C....ok...p..M....B.......A7L..j......QP.:n...6..3....P...................................................................................................................................<...C....ok...p..M.\..'t.a....A7...

C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	155841
Entropy (8bit):	6.355436815190518
Encrypted:	false
SSDEEP:	3072:6Eyi381tvrZfZKGKf/w19dB+ob3uJKqWFyiQxJcIRLsvs5GmSRJ6O9o:6Li+r9ZxKf/w19dB+oDSKqWBQxfYs5Go
MD5:	4F15B6F6898C8055FEE1BE877537AFED
SHA1:	13D22427C60F6B3E27F901C80ABE1A7A5DA4EB72
SHA-256:	336174EE1A2575597A7DBEC9A2568D77D84221E19655757E8E0D9829614262C2
SHA-512:	AE0257D42C8CBC2BA0F18CB56F96AA6F5810ECD2E250C01BB29C76010B6BF953C153D08B9F0B2A1C9BF630E3AE007455074751245B4E44FBFB682E4ECE4C12D7
Malicious:	false
Preview:	..?..mD..g....Mf'.."...@.$........tV`s..@..F.Q.}..I..O="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:mml="http://www.w3.org/1998/Math/MathML"...xmlns:m="http://schemas..7..5_..{....SR'e..."'..&...............o.d......]..J....N..Dthod="xml" encoding="UTF-8" />...... <xsl:variable name="StrUCAlphabet">ABCDEFGHIJKLMNOPQRSTUVWXYZ</xsl:variable>.. <xsl:varia.."@.,_..6....c=$g...!5^[".............tN/v..U...I.}..S..Me>.... %%Template: match ......The catch all template, just passes through ...-->.. <xsl:template match="">.. <xsl:a.+..9W..x......-{...ycVGc..p.Q............fN?>..!.......+.n..Qlate: match *......Another catch all template, just passes through ...-->.. <xsl:template match="/">.. <m:oMath>.. <xsl..7..4...y....E.hd...'5AGi..R.\|..........sRd......V...n..V..D>.... %%Template: SReplace......Replace all occurences of sOrig in sInput with sReplacement....and return the resulting st..)..m.J......X.$-...4-..&............

C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	79074
Entropy (8bit):	7.209678477984062
Encrypted:	false
SSDEEP:	1536:uO6O0kwQtfDrLEcYy2IsFuXcLIRJupzRW3ybGaFyB7:2OymXqy2IsQ3upzRWN7
MD5:	773393E2CBF47EA316FA4DAC7D96858E
SHA1:	3A2CDD448C36A8758CB8A670CD41BA28E0573EC0
SHA-256:	891E0D2D0619E3FE21EA8DAA9BEA4221CFB23BEC35E4B37C0A8D2046C88505B4
SHA-512:	84163E8A2C086AD0233AA65FA7FE0688A4D22218421544D52D8AA433EF3B9133F6815CB0DA85BAA445EF89896BD5776B973D1523E5D2A819E6B45247A82334D9
Malicious:	false
Preview:	......b3.!..!.../"...L...a..l..G..q.=...~i.6.p 9.X..4P....^4$8.........!..L.!This program cannot be run in DOS mode....$........7...V..V..V...X..V.."..V.."..V.."..V.."..V.`$..V.o..%y...o..:l+,l..0.Q..P.C.p....t.EH.Dm..K..o&.G1.z..2a...^<%8.........PE..d...Q5.`.........." .........\...............................................@............`A.........................^'...b3.!...}..k....L..].....G..p....~i.6Ew 9..........^.'8.....8.......................(......8...................T...@....................text.............................. ..`.rdata..#.'...b3.e......"...L...a..,...1...\....b.6. 9.\..4.....^<%8.....@....pdata..............................@..@.didat..............................@....rsrc........ ......................@..@.<B...b30#...M..&......a..l..G..q.}..N~i.6.p 9.X..4P....^<%8..................................................................................................................................N'...b3.!...}.."...L...a..l..G..q.=...

C:\Program Files\Microsoft Office\root\Office16\McePerfCtr.man

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	18830
Entropy (8bit):	5.404061525467908
Encrypted:	false
SSDEEP:	384:4EvMp99Rg4DiF81SecfzGoe9knNKmO9vY:4rRgYiFveyi+HkvY
MD5:	DBC4DB17E69BD06CD5B38CAD37AE53F2
SHA1:	CDE57F21AA90E93AEED45426A9B32D2E951944C8
SHA-256:	5C1213E257A08978A45DEC48E9C98CE3DB2501B9498BB65B51A1A8CE7685A950
SHA-512:	F85BBF427DB120FE9232C144489975FDEE7724444A2EEFA0250C78BB199C5D2DF38009AA8ABE850793BB2FB5F7EFC672BCED52B343C8A05E1960455A085E7B36
Malicious:	false
Preview:	..A.&.":...d(...........$n..=..!.R_)...w'.@Sh..2[bf..+..[..OC8RT.F.-.1.6.".?.>.....<.i.n.s.t.r.u.m.e.n.t.a.t.i.o.n.M.a.n.i.f.e.s.t. .x.s.i.:.s.c.h.e.m.a.L.o.c.a.t.i.o.n.=.".h.t.t.p.:././.s.c..N..t.;:...de...........$f..=..s.._t... '.@Sh..o[6f.q..[..UCBRe.v.e.n.t.s. .e.v.e.n.t.m.a.n...x.s.d.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0..NR.).b:W..d~..........H$x..=..~.._#..>'.@.h..5[rf..5..[..BC.Ra.n.i.f.e.s.t.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.w.i.n.d.o.w.s./.e.v.e.n.t.s.". .x.m.l.n.s.:.x.s.i.=.".h.t..N..#.u:W..d...........$r..=..".L_)...x'-@ph...[ef.. ..[..@C.Rn.s.t.a.n.c.e.". .x.m.l.n.s.:.x.s.=.".h.t.t.p.:././.w.w.w...w.3...o.r.g./.2.0.0.1./.X.M.L.S.c.h.e.m.a.". .x.m.l.n.s.:.t.r.a.c.e..N_.q..:...d2.X........$m..=..>.._p..%'.@Nh..;[rf.&..[..BC.Ri.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.t.r.a.c.e.".>..... . .<.i.n.s.t.r.u.m.e.n.t.a.t.i.o.n.>..... . . . .<.c.o.u.n.t.e.r.s. .s.c..N..t.;:...dz..........J$1..=..2.\_a...

C:\Program Files\Microsoft Office\root\Office16\Microsoft.Ink.Recognition.DLL

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	764090
Entropy (8bit):	6.833324695516105
Encrypted:	false
SSDEEP:	12288:yq1vS+CCLT0NK8psCmuaLfTQJ3nmHBqL+Z05ooBgLv//:y4ZcNKcsCGrQJ3mhr9//
MD5:	346C2231A2D92AA19FE4F9AE28CB5E2A
SHA1:	1B2BEEB1AE6C1818FCA30A88EEF19D5E3A76421F
SHA-256:	547C75CD48883FA17789CA10A9994EDB327CBBD889EC62EC8323F3B740B2563C
SHA-512:	E2F3AD79D600D19BC019DBB4B15E4D04CB9BB22716926B2D533BCAD5E0FD180A62E7F3C75AA48477CB0D380CF524CA4AAB6B52F5C69BD8F2DCE33B0B8C87C7B5
Malicious:	false
Preview:	.V.p.+.w.0..4a.........L.d.])z.zdK8.......W...h.D.....~I.........!..L.!This program cannot be run in DOS mode....$.......g#E.#B+I#B+I#B+Iq/H+B+Iq(H B+I."H%B+I."-H"B+IqH'B+I.+H!B+I/&L8....... .JSC )..E../.N.kQ.:{ep,...W......cC....3...=b.Rich#B+I........................PE..d.....\|_.........." .....(...`.......................................................z....`Q^.rp.+.s.0...a.i.........d.])z.zdK8...G....W...G.Di.....I..@...>.......#......T-...\..T....................]..(....\...............@...............................text....&.......(......^.bp.+.s.0.!.azGh..f..*.`.]i..zpO8.......W...h.D........I. ....`.......@..............@....pdata...>...@...@..................@..@.reloc..T-...........V..............@..B................^.bp.+.s.0...a.i.........d.])z.zdK8.......W...h.D......I.................................................................................................................................^.bp.+.s.0...a.i.........d.])z.zdK8...

C:\Program Files\Microsoft Office\root\Office16\Microsoft.Office.PolicyTips.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	651706
Entropy (8bit):	6.907771042090014
Encrypted:	false
SSDEEP:	6144:YGjG3AXaRB9HCPu+zjxQ9ltaqWb1qGWfq3NSh10Ial9hDF5O9rqm9eAjp6igWbf1:rAAQBUzjxCltad1/hIn0IaQngKYo
MD5:	9FC3828FAE894C367F4A1DC779A1A6F4
SHA1:	2EE40B14EF7B903067A3EF3DD89B4BEBBF79FD12
SHA-256:	185A379659EB78813FB0D4034FB473418F37B61D1D35D6249D3A8DF40A6E8068
SHA-512:	B03C330B35128A68120EA166D930BDB9C160366D9ECC419E967B682E208A472256F918413B60EC2A5606F4F785C80BA21D56D36FDBC89641EE0E19AD991ACDA8
Malicious:	false
Preview:	....A..#.;......K...).!..q4.f;.%..,.!k.A5.d.....pq.G.Q..N....[.v........!..L.!This program cannot be run in DOS mode....$.........\|..........................................L.................^........G...Tg$.\M3..&.....s;....y+x....<.4....+.\|,....L.......Rich............PE..d.../..a.........." ................................................................5G....`A........[.H.B..#.;..74.....).!..q4.v;.%..)..j.A.ic.i...p..G.[..N[....v.....F..........H...8....................a..(...Ph..8......................@....................text...........................[.H.b..C.Ih.CU......)9%...7.f..%..,.!k.A5.d....W^..3\|Q........v.....`..............@....pdata...W...@...X...*..............@..@.didat.. ...........................@....rsrc...................[.H.B..#.;..w4...jF.!.si4.f..%..,.!..A5.d.....pq.G]Q..N....Z.v................................................................................................................................[.H.B..#.;..74.....).!..q4.f;.%..,.!k.A

C:\Program Files\Microsoft Office\root\Office16\cpprestsdk.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	2761754
Entropy (8bit):	7.180538005860296
Encrypted:	false
SSDEEP:	49152:Dp2m/1P6d2PyQ+SjszCKBthJSxANakav0rjCCiyhPw:tL96wPNethQt+m7yu
MD5:	47601E21223AFA68FD9D271A82E9F481
SHA1:	3EC513DF105E67FD7351EA44DD5771CF1E610584
SHA-256:	EEB4C0A98A06259A3B3D4F5359F35A3FFDB8026D71F931D54742542AEFBA662D
SHA-512:	84A72F8019A9EB0BBF7FEAC94EC971A9239E8989D81886411D0E152EA58E2B6B49F8C89C181576BF8B2F3EE46556D56DF38BAB9517562085ABEE359863DE09DE
Malicious:	false
Preview:	....%.1..mr.X./.WQ.>[.=.....#...t....~..v......G....(.x............!..L.!This program cannot be run in DOS mode....$.........$..mJ..mJ..mJ.....mJ......mJ...K..mJ...O..mJ...N..mJ...I..mJ....H..{.E.9..el.H..,fwx...K.i.....\j..,...R.Q...$.hg...(.x....................PE..d.....`.........." .........................................................@..........`A................S.C.&.1..}r.../..Q.>K.=.GE...#...V....~..v......o.J@...x.....).8k....".8....................x .(...`L..8....................X"......................text............................... ..`}.7.R.1...{...4...>[.'.....#...t....P.........D.....z.x.A..............@....pdata...J...`(..L....(.............@..@.didat..P.....)......h).............@....rsrc... .....)......j).........S.S.f.1....../..:.>[...........t....~..v...l..G....(.x....................................................................................................................................S.S.&.1..mr.../..Q.>[.=.....#...t....

C:\Program Files\Microsoft Office\root\Office16\excel-udf-host.win32.bundle

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	176044
Entropy (8bit):	6.697352013494738
Encrypted:	false
SSDEEP:	3072:XH5LNQ0n95aQIMUaVMkHSvbd2ki76r2UM1YUpzj9vf+hW4/UEhE7M:XHP/HaWCOpB+fUEhEo
MD5:	E49E1661CE3292D12A92CC12C562A586
SHA1:	BDCAA9CA3CE00DBC4B83D774DE252FDBB5560E2A
SHA-256:	3F2A4751763493A3350C7D6429897289371C3D7FC28A4BD54D21EF06311B31EB
SHA-512:	FB17C6A2E4DA55BBF86826D5855712E5A67176FF5D1615E4EE8CB7444BCF8B0988AEA3D595610810830D9D0515329312265B12759962885F3017D7F8B1D2EE60
Malicious:	false
Preview:	..}(..v.(_f..{..v..q...Z.....#...Hn.f.k....qa.....k.L.....5var o=t[r]={i:r,l:!1,exports:{}};return e[r].call(o.exports,o,o.exports,n),o.l=!0,o.exports}n.m=e,n.c=t,n.d=function(e,t,r){n.o(..\|o..P.eY;C.oV....%8..M.V...a...Fj..s.u..Z.)s.....0.N......mtion(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defi.X4..z.y.*A..VZ....?$........(...N..\|.m....f`..W..5.K......(&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(n.r(r),Object.definePro..z2.m..d_)..}..0..?%..X.....}..._r.w.0.].#2V.M..w.@.....h e)for(var o in e)n.d(r,o,function(t){return e[t]}.bind(null,o));return r},n.n=function(e){var t=e&&e.__esModule?function(){retu..(#..z.uV;...\|Q.?..$`..K.....m..Ab..`.9....q8V....0.........{nction(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="http://localhost:8081/",n(n.s=6)}([function(e,t){var n;n=func..g(..d.tO=...aV.6.Rq<..B.C...#..ur..f

C:\Program Files\Microsoft Office\root\Office16\excel-udf-host.win32.new.bundle

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	311899
Entropy (8bit):	6.734488328570365
Encrypted:	false
SSDEEP:	3072:xq+NXLmOOpZ3Z39eQFC84WqySo5jWwSgSzf1ZnF/Y2WUJqI5QPaSYrzCzhLUBgaW:M+N76ZJZFsmSKjFSO2uQBnOd
MD5:	730B4E2AC4822CB2BF520C1DAC8AAA1A
SHA1:	5C0F68C6B1BE1F237C3DE8CF76D5AB2BD680B94A
SHA-256:	19CD744C7787FF115CA7F9787331F0AF28FA3F7463F59E23282D2B1FA22973D5
SHA-512:	F9106BE71655D827C9975919F856F8C817DF9D85FCBBEF03BDEE29BBFC9EFDBA992878157F6670DDF3F0F68F3B7D3DB4A67AB26A1B77F7F22FD22339D51286C9
Malicious:	false
Preview:	V.6.o&..(.@'......7I.(....`.....y...!.}D....i}$sB}&-........#.ction(e){function t(){return"undefined"!=typeof performance&&performance.now?performance.now():0}e.now=t,e.officeExecuteStartDatE...T.."..a........Y.$....P.....(H.A .h...+.cm>aS..=..T.S..".nitializationStart=t(),e.hostInitializationEnd=0,e.createOMEnd=0,e.hostSpecificFileName="",e.getAppContextStart=0,e.getAppContexT...E.c.C<..0....D......q.[...6.....~+....~z.q[..=..T.T..?.eOnReady=0}(OSFPerformance\|\|(OSFPerformance={})),function(e){e.definePropertyOnNamespace=function(e,t,n){Object.defineProperty(e..h.G...+.H+.......Y.)..[.J...~...=.l..O.k%`[4.8........+.(OSF\|\|(OSF={})),function(e){!function(e){var t;function n(){return t\|\|(t=new OSF.Association),t}e.associate=function(){n().assocI.0.....!..&........Y.(...<P.H...q..?=.~.....h@xS".8..P....%.ociation",n)}(e.actions\|\|(e.actions={}))}(Office\|\|(Office={})),function(e){!function(e){e[e.Select=0]="Select",e[e.UnSelect=1]="u...L...o.C.......x.=...A^.D...{..+&.

C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	2210
Entropy (8bit):	7.767580403992799
Encrypted:	false
SSDEEP:	48:CgQcMHhsDZ0IFubNFJKUvw4iAqKQktWEy:CgQcMHGZ0IFoN1vjDQkUr
MD5:	CB7EBEB49FF84150CEC61303856E3A6F
SHA1:	B9AD274DF99673CE9CA3A50414CCA9A7BB09DD5C
SHA-256:	DBEC1AF575A16BF197578A0831D13739DB08EE5E8F9BF0B793DD3678446B55FA
SHA-512:	3D7C5E72BF0271F752CC4D6C63656E66FB2AB9ACD5C19098202ED5D94E229BF702D7EE590CAA0CF1D26537891FAF74B26FE6BE24774BC4182CC98E06E73BD337
Malicious:	false
Preview:	'I.....-.Z.k......%......];\..q%..X...A.!...#..(j\....C...S...N...,.B.$......w....B.[<G..#a.p}G....X..tZ..,..lvJ....=............H.B.P...........W-\.QA..a.[..Y.!...$.e\.... ...........1.C.\|.....w......@:.\En'.<sM...V.gX..=..(dP....p...S...N...$.X.m._\|...p......[0[@"%d.2mG...M..)D..(.xzI....p......._......T.u..L...z......ArX..>h.2x\....(V.Vo....0....;...Y...%...$.Y.j.....b......?U<wfE;.8o]....Q. ...$..FvO...+.......e...$...l. ...g.......a.Q.)v.8m\..P..1.....o....G...E..._...3.Z.u............G-\..r..T".....A.#..hG..i\|T....,...T..A...c.^.#.....g......]9AS.#j.>qE..W.,..K;..434../...I...E....K.%.%.L\..4.......E.\..%d.){[..Y.$...#...cI...(...w...C....a.....hx...a......}..7.q%.n+.....T..!A.Hy.n>..../.......J....c...j.....q.....e.;V._BaS.4m....T. X..)..kg\....+..P...M...a.Y.i......}....O..9@..8n.3.D.......Oq.lq.zcV........D.......y...,..H.. ......Vi..[-3.k{........0...?.n\j...G......D...%.Z.u..Q..}....O.Z:...<k.>.\..

C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	Dyalog APL component file 64-bit level 2 journaled checksummed version -87.-95
Category:	dropped
Size (bytes):	1894
Entropy (8bit):	7.744304346906065
Encrypted:	false
SSDEEP:	48:wtyBSxjseGst0GilRlLBXusWOmFq5uJbUA6rg1s1:5BpeFOGylLBXusWOsb4
MD5:	1202C2F4BDC7C953AF354A5014BA607D
SHA1:	8FE608794983845573DAD3E588DC58FEC96ADF21
SHA-256:	EE113E4DCE10357B0098D85BCB08056E91219C2CA130F2A3AA0C6FC6B3034C65
SHA-512:	7255756DE83009FF2D9E8F632B225F0AA051144B03D926EDEE4061F6B19AA324A01F2D64B0579091AA8E06E310D12FE5654AA8CF1413BFA8A0AA01C643AEBA53
Malicious:	false
Preview:	..../B.....3.$...q.._.W.c[....xIk.I.[..._.6...o.Y].v.C...."...y. .t.i.....\|.8... ..D.. U....l./.0.._6._.y..#.VV.2.U.F.\l.7.t.&..7.v.....%...'..@G..cP....!yC.!..Ai.N.....m.^L.t.C.J.A8..;.u.&. .....$.>...!..]..yM...I5Vi.\|.....T.2.x.u..L.$....J..7..6.$.e.}X..../.$...^..SM..nJ....p.w.t..]..J.w.c.f..{.:.C.F...y.7.f.yU.A..}.?.........aV.G..m.s.~.._m...>.i.p.QL.7.K..P..s..4.O...c_....8.@..Z...X..~L....v. .x..A2.&.^...q.FM.'.C..[.Lp..e...`.\|......\|.,...%..[U.xQ....l.t.{..Ai...x.~.v.DL.0.^..V.Fj.o. .(..3.v...$.8...6..@..a]...U.~@.!..Wo.^.#.%......&.U.M.@;....&.{.qN....5.m...=..M\..7K....~.d.t..]..J.z.t.9.XU.5.O.O.[\|..;.{....3....(.,...=..e ~.1..W..zT..=..^c...9.r.b.RK.5.V..@.[l..0.f.bN.....#... ..O.Z..2.s.Wl.9.r..Wh.....&.x....l.......3..l.!..."^....q....`.M.K.~M....k.-.N.{8..%.v.6.k.D..0.P.V..l..c.$.s.0N.....1.$...:.OZ..}W...KH.'.r...4.J.9.o.l.VT. ......&...y.5.y.d_.0...%.o...a..WLD.8..C._+@x...OQ!...3.z.b.R..)....P._u.~.!.E..0.v..l.m... ......aM.Z..{..i...x.

C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	123618
Entropy (8bit):	7.058670612195762
Encrypted:	false
SSDEEP:	3072:vz3rgxpLgbR8Nn0GcAYIx7YkgAFN30E96HTb271fs3aZi:b0x9g4n03vK7LCHI1s3aU
MD5:	72115FB2FBA8D183D4B8B07BE596BBD4
SHA1:	8E91F89375F3C06119014F2D21C17D1D96D3321A
SHA-256:	6D9B312BFB5ED6D1AA3CA510C6921C46EE64F52CC20545546B2916E88F00C457
SHA-512:	13F006FE683E0D4C1DDFE14CAA6CEF855B3398DB8B14EC65EA264BABD94434E4C84507D7247914C61E36779502D09DD668BFC3FFADFFE397C886174ED14B6BFE
Malicious:	false
Preview:	.h....j..\|.@M..h.._<....M..u.q;.G...._......;).9....E......{........!..L.!This program cannot be run in DOS mode....$........m.....Z...Z...Z]~.[...Z]~.[...Z]~.[...Z.x.[...Z.x.[...Z.x.[...Z.L.....0B..].._..x.........y.+m..t6...'F.C...i@.Q....E......{........PE..d.....`.........." ................P.....................................................`A........................."H....j..\|......._....L.=u.q;fF.q.........;..9W..E......{.~..8............................p..8............................................text............................... ..`.orpc...C2H..x.j..\|.l...._<....M.!u....#O..........;..9....E......{....@..@.data...p............p..............@....pdata..,............\|..............@..@_RDATA..............................@..@.@;...j..\|.R...._<r....M..u.q;.G.....-.......,.9....E....B.{............@..B.................................................................................................................2H....j..\|......_<....M..u.q;.G....

C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	452810
Entropy (8bit):	7.3581441467920605
Encrypted:	false
SSDEEP:	12288:f6E7EPMSmT2wmHtOaNgoLIlV6L818cPibTBxEcWI:fjEPMiwmNem618ckBD5
MD5:	D0AE8F777E0061115093F310415F0975
SHA1:	FE6C555D74C89408B075C66A151E4A20A9DFB22C
SHA-256:	3918E4B55CD7DE92423366094A6C5B6D497228A5E334DCA4F14923F18EFCAE64
SHA-512:	78CF9108B8A7C294D0C57D8CCEDA8C4F9D2194BEEA504FB7A76EFC64EE5B1CA9F9CED54A4692B6A0464EBB732D13EC380612D54AFE0E56140E6C94372203CE83
Malicious:	false
Preview:	;....\...........$D....0....vY.>i#..v5.H@..CHe5.f6....e..v.#..........6hheaD=>........$hmtx............loca...N........maxp...E....... name..4.... ...Ppost...<...p... ........U?Z=_.<.....;...D.=...$K..<_Z.....0....Y.<.#..:1....z.6.Z(...2..r...........q.....q.D.<.........................j.......................3..............................MS .@.......(...Q............9)...v.}..............0...Rl<.,..:!.H0.(:.!.-9U.3.Dr..d...z...............N........."....................l..........$A...,.......X..&..............&...(B...............#.......j......"......}................B0.....D.<..>.:=.H0..:.,.-%..3.8r.....<...;>.............. ]...A...........$.......$.......^...................7...........O...V...........K.......c......!.......$....4...&.}........b.......(0.....Uj<.1R.:;OH0..:.#..-+.3..r......o...........S......0..0...M......9...-...2A...... ....n...........3.......A...q...........h......."...W..'... .......Y...F........}................0...H.<....:

C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	991446
Entropy (8bit):	5.408724424326412
Encrypted:	false
SSDEEP:	6144:gDuynJlSd95iJBzv12gB2cp4CNSOS6W27efQSKRdLBXxaZM/Ry0WJZ/EPMTV:4u+zqMh51dW27efmRha29WV
MD5:	9DDED5424FDA5AF224316EA16C79E437
SHA1:	1B837538834224BECAC465066AD291045635F118
SHA-256:	F08251FC1364285AAE02DCC8020F867AC980717A445CD1F0925A309DA55CCEEB
SHA-512:	B6030ECE454892EB130B45BE8AED63C2688DFB4BE6003C17C2CDE3FB0F2BAD8B19A7395E13BDA09134A5200962FA95B756217C0BD44003CFF3040E26D188B08D
Malicious:	false
Preview:	r.f..6......$kg[!...F..[.f.....Qs6?.`..E....,.B.nD.N5.7.V(BD. .I.N.F.O.R.M.A.T.I.O.N.....D.o. .N.o.t. .T.r.a.n.s.l.a.t.e. .o.r. .L.o.c.a.l.i.z.e.........O.f.f.i.c.e. .W.I.N.3.2. .i.n.c.o..=.f..6......k.[....r..[.f.....rs.?.`..E....X...nd.=5c7.V.Bn. .S.o.u.r.c.e. .S.o.f.t.w.a.r.e. .b.e.l.o.w... .....M.i.c.r.o.s.o.f.t. .l.i.c.e.n.s.e.s. .t.h.e.s.e. .c.o.m.p.o.n.e.n.t.s. .u..=.f..6.....k.[<..y..[.f.....Os9?.`...E........n`.o5I7.V.Bi.c.e.n.s.e. .....t.e.r.m.s... .T.h.e. .o.r.i.g.i.n.a.l. .c.o.p.y.r.i.g.h.t. .n.o.t.i.c.e.s. .a.n.d. .t.h.e. .l.i.c.e.n.s.e.s. ..=.f..6......kO[...?..[.f...us.?.`...E......n.nd.t5Z7.V.B .s.u.c.h. .c.o.m.p.o.n.e.n.t.s. .a.r.e. .s.e.t. .f.o.r.t.h. .b.e.l.o.w. .f.o.r. .i.n.f.o.r.m.a.t.i.o.n.a.l. .p.u.r.p.o.s.e.s....=.f...6......kU[...k..[.f.....ts.?.`...E......+.nh.z5D7.V.B .n.o.t. .e.x.p.r.e.s.s.l.y. .g.r.a.n.t.e.d. .h.e.r.e.i.n.,. .w.h.e.t.h.e.r. .b.y. .....i.m.p.l.i.c.a.t.i.o.n.,. .e.s.t.o.p.p.e..=.f..6.....kC[...v..[.f......s}?.`

C:\Program Files\Microsoft Office\root\Office16\mce.dll

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	2328842
Entropy (8bit):	6.926624009424322
Encrypted:	false
SSDEEP:	49152:sv+pNLWujzOC01qP0ZdAtf9W8OHo/RyE4RikIPRSUW:sv+p8uGC0ooc1VJFpPRSV
MD5:	528120BC1A649EFC731DFB4ED1023BFA
SHA1:	7CED4C675A76395B1CA08157399FECD5A49D92E8
SHA-256:	77385B1A2459B72118BFCE6E78A59E16D43AA1C871C79FEA23A199244B91FE6C
SHA-512:	584FA6DAA346EE15634F2E74733D3372EC0AEAF0CA80A75A9CAB125361624A70B2457121DBA0D3348A1E4AD1578CD3CF106E8803520A6B11F221D4C7EDB66491
Malicious:	false
Preview:	2B.o.t:....;G...1,.xUH....S..(...=U@...DPY..;r...f..@..{.h4...W........!..L.!This program cannot be run in DOS mode....$..........)U.kzU.kzU.kz...zW.kz...zT.kzU.jzT.kz...z@.kz.b.z^.kz.b.z..kz.z..8.Qq.]hA.a..M....p....)SEC.`../.#k.61..\.........`{.h4...W................PE..d....t[.........." .....\|....................................................#.......#...`...................yo.t:....;.....,.xEH....S..(.B."U....D`z..r...G.2...{+K4\|J.W.`#..=......8...........................0...p............................................text...kx.......z.................. ..`Qw...t:....;.......xU6...S..(...=U`...j"=.\|Zr...l.....{.b4...W............@..@.data....(...p.......L..............@....pdata.......!......2!.............@..@.rsrc...."...0#..$...."...........io.t:K...W.\|...O.xU(8...S.8....=U@...DPY.H;r..f..@..{.h4...W..................................................................................................................................io.t:....;.....,.xUH...S..(...=U@...

C:\Program Files\Microsoft Office\root\Office16\misc.exe

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1039514
Entropy (8bit):	5.490537132961183
Encrypted:	false
SSDEEP:	3072:XiD8ffKOcwoMCvQB4YMyMLkoJjJzJQzhXNRllPlX1k20Uyd:yDgoMGa6LNVRINfxkwyd
MD5:	CC46AFF011AFE22E2735CE54A03395D5
SHA1:	BC5D85B635B1A6E52354CA53D12330B9C29713A8
SHA-256:	05D52ECE6394CD7D23B0B8742746E8ADD3168C98542DE644BDBDA85D85B1980D
SHA-512:	5D56EB4C0956835E7FBC8C21FD5DD9298B8F3EF0D71A9E045587566462D64925FE0A70467A8E20EB91ED5529A3D39C1B5A3E41F8D2342E67DF9DEE4AD12F5DD9
Malicious:	false
Preview:	..\|8w.LK....\|E...9.........G. .yA....z.<S..xk....I.....1&c..........!..L.!This program cannot be run in DOS mode....$....................O......O.~...........O......Rich..............8.fNK7......[9..<......G. ..vA....z.<S..xk...1.I.....1.a..........................1.....`A........................................ ...8............ .................`E.....................8t.LK......[9.........G. .yA....z.<S..xk....I.....1.c...........rdata..............................@..@.rsrc....... ......................@..@...........................................8t.LK......[9.........G. .yA....z.<S..xk....I.....1.c.....................................................................................................................................8t.LK......[9.........G. .yA....z.<S..xk....I.....1.c.....................................................................................................................................8t.LK......[9.........G. .yA....

C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	4410
Entropy (8bit):	7.072038580464627
Encrypted:	false
SSDEEP:	96:pXSbaWHhETnVEVEVEVEVEVEVBdVEVEVEVEVE/wirIWB5ZKHn3f6vRzguI2VEVEVu:81yJQSHmgum
MD5:	D1B179BB6C876E77B09374FD3BF7AC50
SHA1:	5813F88484214BF75D189ACB054B6C0C9F4ABFCB
SHA-256:	88E564D33464C81ED1D30A314B2333A4F7601C8CE38EE65F6898246E7695F59F
SHA-512:	921E50D04E7FA9C0A262EC76B2A586E76D2852565CC1A1CBB1F381C9BDB2102CAA4207B306531CD736B7B6EBC13F7A7CAAFDA5C8D926C7FD6C9BA99DCBDBC073
Malicious:	false
Preview:	....(.fl....r..t.F...y.t@..P..L.Y.&=.~.......pu.........ji.G....+io..<.K..u.wf.{v....`...>.ml.<1THr^.j..............j..G.-...,...u].,\|!.%...9..Y7.>h...e(...!.......V]X"...b.=...j..G...a.+.fl....y...}.G...y..t@.l.r..N.E.&=.~.......pu...........G...a.+.fl.........G...y..D@.{P.xK.Y.&]]~.......pe.........j..G...a.+.fl.........F.1.y..t@..P..l.Y!.=.~.......pu.........j..G...a.7.fl.........F...y..t@..P..L.Y.&=.~.......pu.........j..G...a.+.fl........v".}xy.bt@.oP..N.Y."=.~.......pu......vp...G..a.+.fl.........F...y..t@...P..L.Y.&=.~.......pu.........j..G...a.+.fl.........F...y..t@..P..L.Y.&=.~.......pu.........j..G...a.+.fl.........F...y..t@..P..L.Y.&=.~.......pu.........j..G...a.+.fl.........F...y..t@..P..L.Y.&=.~.......pu.........j..G...a.+.fl.........F...y..t@..P..L.Y.&=.~.......pu.........j..G...a.+.fl.........F...y..t@..P..L.Y.&=.~.......pu.........j..G...a.+.fl.........F...y..t@..P..L.Y.&=.~.......pu.........j..G...a.+.fl.........F...y..t@..P..L.Y.&=.

C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	3386
Entropy (8bit):	7.007408481054529
Encrypted:	false
SSDEEP:	96:pVUYfNchNfNfNfNfNfNfNf6NfNfNfNfNfN8LMtW4/n8A6rzi6d+dj4PfNfS:peYFcfFFFFFF8FFFFFqMn8R/i6odsPFK
MD5:	7BD2F389A9C82127942B890B3F74DCE1
SHA1:	F4833A4893FCB07F23A764B29056F60B80A394B3
SHA-256:	151315A42270976AB56CDD277DD8EB689C4065ABEB64035A14C72787D3F3084B
SHA-512:	559BB82E8095ABFC8458191046BBC53255069C98094D733FA91B18D03009ADD95442C8CCFB0324444B4C99056BEEB825062B21AF175F848F13D629E1F335FBD4
Malicious:	false
Preview:	......,.......O...:..I.O8...=,P....Kc_._.~.r%..W%.Yi.B.mN...+.."..T%..H...}D...H}..h.o[.p.RXp...{>...1.:.!.j.3@.Td.f.mNi..+.Hww....../4V....2wA..V1.*1........V....K.RN..U.4M...B.mNi..+.....,.........`...:....O8R...'R....Kc_._.~.r%..W%.Ii.B.m.h..+.....,...g\.....:....O8...=......+"_.O.~.r%..W%.Yi.B.}Ni..+.....,...w\..........O8...=,p...Kc_._.~.r%..W%.Yi.B.mNi..+.....,...g\......:....O8...=,P....Kc_._.~.r%..W%.Yi.B.mNi..+.....,...g\.....Ns...O8...=,R....Kc_._.~.r%..W%.YiDl..<...+.....,.....gZ......:....O8...},P....Kc_._.~.r%..W%.Yi.B.mNi..+.....,...g\......:....O8...=,P....Kc_._.~.r%..W%.Yi.B.mNi..+.....,...g\......:....O8...=,P....Kc_._.~.r%..W%.Yi.B.mNi..+.....,...g\......:....O8...=,P....Kc_._.~.r%..W%.Yi.B.mNi..+.....,...g\......:....O8...=,P....Kc_._.~.r%..W%.Yi.B.mNi..+.....,...g\......:....O8...=,P....Kc_._.~.r%..W%.Yi.B.mNi..+.....,...g\......:....O8...=,P....Kc_._.~.r%..W%.Yi.B.mNi..+.....,...g\......:....O8...=,P....Kc

C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	3386
Entropy (8bit):	6.968380700744651
Encrypted:	false
SSDEEP:	96:BaJJ7cVcVGGGGGGG/raGGGGqSRlPTzKmkNZz0/GNGGyYl:fHrSnTXaz0/Al
MD5:	CAEAEF8184CD4C72519ACE0B7279E2F3
SHA1:	41B22342E59E6E30CC91EE8848E570A489EA6DB8
SHA-256:	D26E7C8E3B2D682A9B180A020B95EBE57BBE86DE771CAF05838CC935B488B686
SHA-512:	3159947A3954CCE7E490C5CF4A9CF360C30CF90C2DCFF4AEE869029773156D1732AA6D415FA316AF696E3D582349D06E4F7CE09F211DB3A3B9A6EB813AFB4B66
Malicious:	false
Preview:	.5.If..0...@.Nw.'....N......3,3.4..^,=.A;{..M....w.(.S.b.....p.Ge...7)..r...:T"...d<.....EG.Q....0.T.a.4.' .s..z.".S.bP......TB..'`\5.......E....)d.p.;....% ..]..O...Z...t..F..S.bP....o)Ie..0F...Lw.~.....N.......8.=.4..^,5.A;{..M....g.(.S..Q.....)Ie..0....$NwU'....N........3.7..,=.A;{..M....w.(.S.bP.....)Ie..0....$Nws7....N......3.3.T..^,=.A;{..M....w.(.S.bP.....)Iy..0....$NwS'....N......3,3.4..^,=.A;{..M....w.(.S.bP....o)Ie..0....$Nw}Uf...N\|.....3.3.4..^,=.A;{..M....w.h.!..3....j)Ie..0...."NwS'....N......j3,3.4..^,=.A;{..M....w.(.S.bP....o)Ie..0....$NwS'....N......3,3.4..^,=.A;{..M....w.(.S.bP....o)Ie..0....$NwS'....N......3,3.4..^,=.A;{..M....w.(.S.bP....o)Ie..0....$NwS'....N......3,3.4..^,=.A;{..M....w.(.S.bP....o)Ie..0....$NwS'....N......3,3.4..^,=.A;{..M....w.(.S.bP....o)Ie..0....$NwS'....N......3,3.4..^,=.A;{..M....w.(.S.bP....o)Ie..0....$NwS'....N......3,3.4..^,=.A;{..M....w.(.S.bP....o)Ie..0....$NwS'....N......3,3.4..^

C:\Program Files\Microsoft Office\root\Office16\mscss7wre_en.dub

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	104250
Entropy (8bit):	6.483414299049183
Encrypted:	false
SSDEEP:	1536:p5BxQr+lY/mwxi1vH98KGiUVCYPN2xAKf:p58+lYOPvH98SEKf
MD5:	712CD9726EC32C0E96126CAE1C871D66
SHA1:	09394790DAF5AAA8F56CCA3C8CF6265364DCD48C
SHA-256:	6C7934189C0BECE794F50E1539837101BDC9FD59C52F76A4609A0A5E412DE8B5
SHA-512:	EE74D0EEF545CAD8D5CD0CEEAAFC4FC8020EA1B79CFF326606EF9F1DFC542CD337CA4872F542E454764AC57C6E89BCF45A3997709B5815C193F774171420F2A2
Malicious:	false
Preview:	.>..od......{.....?.,..Q..3v....5b..s.4.P...[.^C~..c...y7.0rXjU........!..L.!This program cannot be run in DOS mode....$.......u...1.1.1...0..~.0.1...0...0.Rich1.........[d,.ld............<.,..Q..3vf...>`..s.4....[.^C~..c...y7.XjU................................3.....`A........................................ ...<............ .............................[t,.pd............?.,..Q..3v....5b..s.4.P...[.^C~..c...y7.0.XjU.................rdata..............................@..@.rsrc....... ......................@..@................................[d,.ld............?.,..Q..3v....5b..s.4.P...[.^C~..c...y7.0.XjU................................................................................................................................[d,.ld............?.,..Q..3v....5b..s.4.P...[.^C~..c...y7.0.XjU................................................................................................................................[d,.ld............?.,..Q..3v....5b..s.4

C:\Program Files\Microsoft Office\root\Office16\mscss7wre_es.dub

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	3386
Entropy (8bit):	6.9614973704714025
Encrypted:	false
SSDEEP:	48:oySpaoE3Io45mO6CkiPZRleS60VPwLhrZOVRniRVF3fRF1o4:oFQIXmO0iPZRnvRYhrEV0PF3T1o4
MD5:	5E56D1003E672960CC0208497BDDEC54
SHA1:	8772CEA9BB39A1905B96FA7C989CE955F605A11B
SHA-256:	0FC707B5F39BF00B244B1EF68F5AA418D421FA83FD8DE96D0B1D815330C5E3C6
SHA-512:	A2B0EC24ACB5A50F23B0B7D1D537C50606036BBC59ACD61D03B978A7328C8F727EA39FAAC4EFB1E1ED805D041C57BBB8B850A5F5C0937F021A1F321DB968B6A9
Malicious:	false
Preview:	.C`d.UY.C..!0.?Z......W..Tr.K.B.....j.......!..U....S.`....Jj..P......FW....d.}.va.7.D..?. ..ml.J.t..L..L..0...S..........\..du.>...J.d&..)....B.d.zVT\....l.4....s..=.`.P.S......d.UY......I.?s..........T..@.L.....j.......!..U....SQ......d.WY.C.....?........<.Tr..3.B...y.j.......!..U....S:......d.UY.C.....?.........Tr.K.B.^...j.......!..U....S......d.UY.C.....?..........Tr.K.B.....j.......!..U....S......d.UY.C.....?..b......Tr:.K.B.....j.......!..U.....!Y....!..d.uY.E.....?..........T2..K.B.....j.......!..U....S......d.UY.C.....?..........Tr.K.B.....j.......!..U....S......d.UY.C.....?..........Tr.K.B.....j.......!..U....S......d.UY.C.....?..........Tr.K.B.....j.......!..U....S......d.UY.C.....?..........Tr.K.B.....j.......!..U....S......d.UY.C.....?..........Tr.K.B.....j.......!..U....S......d.UY.C.....?..........Tr.K.B.....j.......!..U....S......d.UY.C.....?..........Tr.K.B.....

C:\Program Files\Microsoft Office\root\Office16\mscss7wre_fr.dub

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	3386
Entropy (8bit):	6.983662952064434
Encrypted:	false
SSDEEP:	48:4fVPMaQ0EWLiHwwwwwwwNL13fEwwwwZGWI9QLwkTQDratDDVZX9QeT/21wp7q:IV1LiWdhb3at3VZNQ0/Jq
MD5:	BFF6BFF751CDC01A51029A56143633BE
SHA1:	E4AEC5C557C053B3B662553BFC623063A8F4B88A
SHA-256:	7E73512E036E68DC55F4C2284B0391B0ACACED529C8C71D011EB3BC174608164
SHA-512:	4768B488D1709EB244AC7D418B6E9DF308C350D964829E7C525880B74C2570944A1069570A45FA6999B655FDC41F919E4173F561E61E5550A7C1D1B7E4A10F88
Malicious:	false
Preview:	/.....O.-....~7..f.wt.x.i..h...XP............A....uL.o..l...u...................=.b.....=p.n.>C....g$....uL.o...k...0....~.>...f'...D..U.c.3..B."..`}.H..Xr.Z~1.`).:n...uL.o..b.O...O.h..k..~.....wt.x.i..J...DP...."........A....u..o..b.O..O.-...6.~...f.wt.H.i..h...XS.{..........A....eL.o..b.O...O.-...6.~...f..wt.x.i..h...X.............A....uL.o..b.O...O.-...6.~...f.wt.x.i..h...XP............A....uL.o..b.O...O.-...6.~..n...wt\|x.i..h...XP............A......>do....O..O.+...0.~...f.wt.x.iC.h....XP............A....uL.o..b.O...O.-...6.~...f.wt.x.i..h...XP............A....uL.o..b.O...O.-...6.~...f.wt.x.i..h...XP............A....uL.o..b.O...O.-...6.~...f.wt.x.i..h...XP............A....uL.o..b.O...O.-...6.~...f.wt.x.i..h...XP............A....uL.o..b.O...O.-...6.~...f.wt.x.i..h...XP............A....uL.o..b.O...O.-...6.~...f.wt.x.i..h...XP....*........A....uL.o..b.O...O.-...6.~...f.wt.x.i..h...XP...

C:\Program Files\Microsoft Office\root\c2rx.sccd

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	15621
Entropy (8bit):	7.171584060846792
Encrypted:	false
SSDEEP:	384:gFxiKIdyTqn7+ti5pOHm5P700xDX9jeCahQ+3hZPziyJ+qFie697:gFx86qnui5pOwP700xDX9jeCahv33p07
MD5:	27B431A6E6980CCDDC69D6B616BF6375
SHA1:	D0C4F395A7FFFC6EEA0EC68FC862F9799258B290
SHA-256:	FD71318B7D4D9C3E18345D4CCD4EA2BBCBFE04A3EB42133FBD2937459E5EB4EB
SHA-512:	DF84AF51440E1FE6431D58DD7384FF0E77E8047D0FE13189F3B4D05D59B8442CBE6EB50FC455D6E11E677E77C493B8845B2882B6838F26EFA7592C598E8F40B0
Malicious:	false
Preview:	..+.p..Y.!.o~.C.j.ao&.....n..3...?Z..Y*~.!0#>..v[.'-..k](...tor xmlns="http://schemas.microsoft.com/appx/2016/sccd" xmlns:s="http://schemas.microsoft.com/appx/2016/sccd">...<CustomCapabili.\6.".5.n.uc.....3.!..... ....z.a.~...<pIJ1(- ..VI.!4.,zqs...yb3d8bbwe"/>....<CustomCapability Name="Microsoft.classicAppCompatElevated_8wekyb3d8bbwe"/>...</CustomCapabilities>...<Authorize.p=.u..Y.l....].1.+ 1.....n..g.\.M...2qX"3)%?..z\...0.?a]$..Office.C2RX_8wekyb3d8bbwe" CertificateSignatureHash="279cd652c4e252bfbe5217ac722205d7729ba409148cfa9e6d9e5b1cb94eaff1"/>....<Aut.Z!.f..y.&.ti. .4.",(....m....&.I.?(..!yN.40b....t\..\|.2.6Y....3d8bbwe" CertificateSignatureHash="b116c36fa11678efb3bbf1fb1ef99b6b5ca9a85ba290736c6ced9fb0cea2cb01"/>...</AuthorizedEntities>......h..S.l.IY...... .....A......].w&..?y~%..4...U^.&2..T.....EFADCCARAGCSsGAQQBgjcKAaCCAQEwgf4wDAYKKwYBBAGCNwwBAQQQvlDSv13nQkWnWYx6y6RRbBcNMjEwNDE1MDczNDAxWjAOBgorBgEEAYI3DAEDBQAwgbwwgY0EIJ.M#.(....0.e..2.6..`......Q....s.y.)\...

C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	125493
Entropy (8bit):	7.932771239106588
Encrypted:	false
SSDEEP:	3072:C/DaYQyza/7vaK9q1jjOkPuc7/wSVGQEstFMJnas:Cbna/7vz9KOlpSVG4PMr
MD5:	04D53C8854CDF1B2338A5F621A75271D
SHA1:	756325DF0C4172885279AF43D050EF2EBBEBAB8F
SHA-256:	A57035BC71437F1E17AC05CFACCCAF9CD502C8C674D12D5580A369865ADE9B8C
SHA-512:	61DE15E2AB059C41F1F4E9268ED7363F364AFCAEB01E14FB74629653ABFF34E2BB6338E1EACA2BFB6711839D7FE521F63FAF7C9322BEE5CA4726062B50FF39DA
Malicious:	false
Preview:	U2_.......yE[i..).C.'...<..J..T&q.-.'....xYfX.\U......P...,. .#..x264 - core 142 r2479 dd79a61 - H.264/MPEG-4 AVC codec - Copyleft 2003-2014 - http://www.videolan.org/x264.html - optio;Ae.........!f1.. .R.z...<...j..=,z.-..f....=jUz"?m.Lu6..T...=11 psy=1 psy_rd=0.40:0.00 mixed_ref=1 me_range=24 chroma_me=1 trellis=2 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=0 chroma_qp_of3A:...B_......4f1..(._.t...i.../../}1R;.O}C...d+.;+)m..h%.X....imate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=16 b_pyramid=2 b_adapt=2 b_bias=0 direct=3 weightb=1 open_gop=0uE:..........5t..t...p...y...w..\|3`.&.EkR..V,0..=;..L`%..IR..rc_lookahead=60 rc=crf mbtree=1 crf=22.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 vbv_maxrate=17500 vbv_bufsize=17500 crf_max=0.0 na9m7..........+>r..d.@.g...b...z..-}2Hx...&Y.f.....Zd[t.....O....U.#a..W.....i=.JQ..^..gi...............aa. .>....zjfx.c.....S. .,3P.t,...c........r...]........E..t.....m.he..Ej#.m........p....r...P.D.0.}p.....J......

C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	118613
Entropy (8bit):	7.919692356249128
Encrypted:	false
SSDEEP:	3072:LYyPixPQwZtfngBXSGK9BFhKtvEIX90sTf/9Is160s:LYKRE9gBXSDvRq9ZCLR
MD5:	04F6D663B44B592AE8E25853D02DD9F5
SHA1:	2F65022BFBB009B800095C96D9DB80562639D959
SHA-256:	78EB8FC702CDBAFE113582C02C2D7B0F247F0C3E646769D912C619F8BFA48B43
SHA-512:	D30495F777BA7FD94E12B1F6A6F9265E2418BE9A6B838B7D9828F10475BC26707A6BB3E22FC54BF7DC0B83D8756DE5C3CB8247635EF3413EC9E62CD64118E380
Malicious:	false
Preview:	.-....r~S... .#.....t......+'M/i.#...\..D.JZ..n...{k..!..E..,. .#..x264 - core 142 r2479 dd79a61 - H.264/MPEG-4 AVC codec - Copyleft 2003-2014 - http://www.videolan.org/x264.html - optio.^....\|3V...D.{.L...wP....Qj)M...J...a.m...C..].#.C..F..jw...=11 psy=1 psy_rd=0.40:0.00 mixed_ref=1 me_range=24 chroma_me=1 trellis=2 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=0 chroma_qp_of.^.....kf.^..Q.{.L...p^....4/{.J..X...0.v].qO.\...C..[..)"...imate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=16 b_pyramid=2 b_adapt=2 b_bias=0 direct=3 weightb=1 open_gop=0.Z..."<GP..K.>._..YpZ....46z..Z.....9.`L....G..<.!.S..jjI..rc_lookahead=60 rc=crf mbtree=1 crf=22.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 vbv_maxrate=17500 vbv_bufsize=17500 crf_max=0.0 na.r......qkG]..N.8.\...DM....Vj=H.I.Z..Yr.%8..;.....u.@..&..C...1.tE\|...v<..e.............v.v...I....ZD.L..kc......h.....&.)...(.8K1Z...e7.. 1./......i..v....PH}.4..h+.fd..8...,.......d..-.E......g;.."...l.a8.7S...n..#..5F....

C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	483653
Entropy (8bit):	7.718480743826927
Encrypted:	false
SSDEEP:	6144:gUM1hbNOUpKmXf5OA89nAkGRHFScAAOGUsXW74Ch9kDsnbL3cEdRm5+M/ZM:hMpKKhJ89nAvRgqdP49kgnvz4X/ZM
MD5:	DABF15E29BC494B8AA826E362589258E
SHA1:	D0235BB6DD4B2DCC28A3F9057DDD40CC544CB749
SHA-256:	D25FCCDE0ADB54DF753ADD395F4E253919D321366972B19DB3345194D22F16EE
SHA-512:	8930F17E21717DAD5E9DAB7B409CF5F8174909BB170E1971FE113136A2F17BDCBD1F0704BA70000CC7E8C11D460DA07D23C59593A526ECA9E4130122B02D63A0
Malicious:	false
Preview:	..y.!.$..[eXG......?..op..5L..e....q.f..U..-F.J.......5..RQ..t.M#K.//h.`.........K............l......p.p..................>...>..<Z....._......... Se.................... Se.......FC\|...K.)9>.\|.`...c.e.F.>.......o...5.iH..GF.\...h..q..."..........cs.%8=z.A.s.p.e.c.t.R.a.t.i.o.X...................A.s.p.e.c.t.R.a.t.i.o.Y...................I.s.V.B.R.........4.......D.e.v.i.c.e.C.o.n.[.....c.e.G.2....Z..o...5-.....1..'NlU..A..".........ys.%I=..b.e.r.O.f.F.r.a.m.e.s...........]..&.E.G._.e..R...........t......E............................................................=...c.e.G.2..?..op..5L...t.1...wN,U...."..........ys.%<=z.................................................................................................................................=...c.e.G.2..?..op..5L...t.1...wN,U...."..........ys.%<=z.................................................................................................................................=...c.e.G.2..?..op..5L...t.1...wN,

C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	822350
Entropy (8bit):	7.490581886510828
Encrypted:	false
SSDEEP:	12288:VKXrEh2I2qR7utruuUt1oCcFNTxtj44GxY1nj:VKXrEhwgFus1dc/VtjNGO1nj
MD5:	2E972579196A1B8E82B27482A3E45154
SHA1:	719B6C9460C98BC38D71B73E9C206166CA32EADE
SHA-256:	04E0FA698EC626EE7E0323D97B3F334339D54359410888DF0A1F3BFBB85CBF1B
SHA-512:	FF6F21A7799AE7E0506A3542DF7D47CA789B2973CB1C25DD5671B6975F107362C42CE3737988269B0816571D246EDFD4D983AA4E16C58BB2740539728EA7A5D4
Malicious:	false
Preview:	.50..QK.+.x$o.!0...=;.I...R....1.D...R..`...0.....e....A.B.....v.!............m.'............[........r..................>...>...\....._......... Se.................... Se.......FC\|...K.)9>.R..[.Z....%.8(e...=N.:......yb.SK.h!PX<.P..U.....`..z.E.4....P.A.s.p.e.c.t.R.a.t.i.o.X...................A.s.p.e.c.t.R.a.t.i.o.Y...................I.s.V.B.R.........4.......D.e.v.i.c.e.C.o.n6u..\|..7....$n4(e..=V.9..3.\|...$.....\....U.....{..z.E.4....=.b.e.r.O.f.F.r.a.m.e.s.../.......]..&.E.G._.e..R...........t......E...........................................................6...\|.Z....$.4Me...=;.I...R....$.W........U.....e..z.E.4....P................................................................................................................................6...\|.Z....$.4Me...=;.I...R....$.W........U.....e..z.E.4....P................................................................................................................................6...\|.Z....$.4Me...=;.I...R....$.W....

C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	104610
Entropy (8bit):	7.934565390856922
Encrypted:	false
SSDEEP:	3072:k2oHsAI8ds/DRHOlR3RrHMtLB0fbu70FcupLVDrG8+1FS1yyhhW9g:k2oHDdds/DV0RhAxIuADtLS2
MD5:	2ED11753C0CA4B702CE4DFCB2C4BF53A
SHA1:	E49887C007326D79323FD90BE18A0D147E0CADF7
SHA-256:	38BE4AC89BC9F3D8C664080F1F15112EE1C9ED4DF4A88747A7662038CA075964
SHA-512:	EABA1799E413383E3A19EF2BB3AC5BAE344CA037737AAF5E3B843F4FA6DA78E69A70021B73182A884FE4001A1275C0AB7FC9C61AD0A8540DCBC1C299B7106EB9
Malicious:	false
Preview:	.....Gg..[&,mb.+..V O......"..C..r.}z.L.j..XkY.l.a8e..z..s."m(..,. .#..x264 - core 142 r2479 dd79a61 - H.264/MPEG-4 AVC codec - Copyleft 2003-2014 - http://www.videolan.org/x264.html - optio.z...\v..^4^...s.]_,^......u...c....vl.q....r.._9.[]nL.......=11 psy=1 psy_rd=0.40:0.00 mixed_ref=1 me_range=24 chroma_me=1 trellis=2 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=0 chroma_qp_of.z.....7...qM...s.]W&S.........&....=?. ....c~E..x.M]*.......imate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=16 b_pyramid=2 b_adapt=2 b_bias=0 direct=3 weightb=1 open_gop=0.~...Jg..O.I...6.N.y.........~..Z.lz.).....:...m._?hL......@rc_lookahead=60 rc=crf mbtree=1 crf=22.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 vbv_maxrate=17500 vbv_bufsize=17500 crf_max=0.0 na.V....Px..OrE...0.M. L......r..s....>%.b...4<.- ...>u5.8.x...2..Y.?..9....[.R...."."............o.?.w.FK.........Ss....T.!x.......`...'....2.. u.3.o..j...........E......#........."....@....M...r.E6.".......~F.K.m.i..21}........'.u

C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8_RTL.mp4

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	105274
Entropy (8bit):	7.933397878861932
Encrypted:	false
SSDEEP:	3072:4zH2hJe+Th46P891MlET3brnKukf/2tOLmzqmhQ:fhJe+TiDDMlsHwkumM
MD5:	8BAAC09E5EDCA8758A7C5DE0A598BE71
SHA1:	4FB0F18E7E1D8E48BBF0E451286BD5AC78F39039
SHA-256:	C7CDC0BDA4545CA3E91663F7EFEF31E791E08AC52F6FD3358624B49C8E3A1CA9
SHA-512:	C55B7C8271917D4BAD5A536AAAED0AA6B277ED20CDF6A5D2511B02751F6A8D71A620EBD3E00A2DF06464B99CEE6A576AF9186BD27F36B4B67C7D625E5F6C448F
Malicious:	false
Preview:	7v..........3....5..V..D:2....>..j.Z.Y.{.-.....F<.Z.........,. .#..x264 - core 142 r2479 dd79a61 - H.264/MPEG-4 AVC codec - Copyleft 2003-2014 - http://www.videolan.org/x264.html - optioY.........g.W....<..U...:e...._.`.L..h.A.y....._....m..c.K.=11 psy=1 psy_rd=0.40:0.00 mixed_ref=1 me_range=24 chroma_me=1 trellis=2 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=0 chroma_qp_ofQ....P....^.t.B....4..R..Fo..H._.1...F1..........I.L.~..6.C.imate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=16 b_pyramid=2 b_adapt=2 b_bias=0 direct=3 weightb=1 open_gop=0...........p.X....h.R...I...T......Z.O;...}W.....[....~..~...rc_lookahead=60 rc=crf mbtree=1 crf=22.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 vbv_maxrate=17500 vbv_bufsize=17500 crf_max=0.0 na[)..@......\|.]...x..f..Ndb......1....nFr\Ig.f.(>:.B..~.....^.E.U+...R-. ...........J.Q.......e......%.....h...........@.e.$......3(.. .....T.....`'..>.Q..@..........................-4.vA.Gm.,....L..w...=.....q..WY.....I

C:\Program Files\Microsoft Office\root\fre\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Microsoft Update Health Tools\Logs\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\META-INF\cose.manifest

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	323902
Entropy (8bit):	7.102657916189677
Encrypted:	false
SSDEEP:	6144:cjk3TGt3A8NtoCTgx3zLPyEZFQu1kaG7HYc5:6v3AyOCTgx3zLPyEZk755
MD5:	4E9AF4EEDB69CF13C99D2505B103DEA2
SHA1:	26E2C7139FA3A676E6ED16338DD2097DE747412F
SHA-256:	0876CA793464854E3CAC4A9579813439D528E55B2D5DBBEAC37EC190DC4DC177
SHA-512:	720C857AD8FA0C610FAE58BA38B2E9B427A336D5311D00C2114CEDD3E09EA67C229E38AC54D4795828F6D6E2F43FDF9150B23437781083B002C2621D43475D69
Malicious:	false
Preview:	Y.......oP...a....y,.a........(..c....y8...6.=..D^>.9...... SHA256.SHA1-Digest: lHuoFcq64iBflNZTC3JaDS6PR1M=.SHA256-Digest: L3pqv/tEQz8cYLUzNIindHGe9Hh86/OgC0SLoDl7NK0=..Name: chrome.manir.......AJA....`...$U........E.{......y8...!....@zz...%..?..dRl1LE9f3wSc=.SHA256-Digest: qUb6sqB+1ehcMl37UEBjvuz772xZcXCll3QB0HK6uMQ=..Name: chrome/chrome.manifest.Digest-Algorithms: SHA1 G..V...;lx.....j...G.L....\............?....&......\|...w..3.L/zGB69W8rzefduBjR3yPocu1dg6IS+t5gZ4JDFZUAs=..Name: update.locale.Digest-Algorithms: SHA1 SHA256.SHA1-Digest: xKsBObpw2lIlOkm1UQx........?..:....C.[....]...'........-^....].&..o.{.g.w....HMv8A=..Name: res/multilocale.txt.Digest-Algorithms: SHA1 SHA256.SHA1-Digest: xKsBObpw2lIlOkm1UQl7wxxLma4=.SHA256-Digest: RrpqqdD..2..\RL{....I...........~..?.;..p.9}:..t.!..SY>.{....(..nts.manifest.Digest-Algorithms: SHA1 SHA256.SHA1-Digest: vcvS8U3O17Q63WtgrIGRHnb5eKY=.SHA256-Digest: jz/iZaCNrCvc247LsA3/T/r+Y7a[......Wf..^...(K......B....`..b..

C:\Program Files\Mozilla Firefox\META-INF\cose.sig

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	3412
Entropy (8bit):	7.884381242133774
Encrypted:	false
SSDEEP:	96:dDyZHSca8KIvG0TkarTwCGq5nJomIKRqiTnKJqfBCL:VyZyc1fGZaQC15lIO12cfg
MD5:	70481DBF4165E95CDB63BF2770D4C903
SHA1:	BC5E9A8B78EC1481F96FE6FFDD31D9FA2D8D06C2
SHA-256:	E691CE71BA43E325D7D1C3B3D2899CFF420D2B4919DC643EF5CFC68F9E6300D0
SHA-512:	63D5B180E257F9B7D32378B242C3A951A5A1B57CFE5BA67DAAECA1BC6F06681C64736F4AA160AD46EB31F862A727FE660ED7170D983F89EC98AC8CE318232687
Malicious:	false
Preview:	.}.....n..q.......... .,.V.!..+.\|.Qx...)j@.....H ..f\..~.:Kr.4e......'<....k.......BtD..d....%.q...W0oA. ..f..c@...F;...I).H@.q..G...:....:.....t5rB..x.@.T....Ds0{..!..9..r%...h..L.Y y".V/.. ..Zc.F.......dv.+......<.v..:.LXG.%.F..,b...R,...FJC)-6...2...:...K.......VcY..;.r..H....c.-cA.).....@E...+......N.M~.{..D>....f.....F..+....?.'.t..Vu'fM...]../q...^h$.^.d\|g..+.t....oS..........Xe"..c....x..v>...O.:.B..A.j;..R..76b...4....._.-.2bjd..D....>.....J..kj....NNW..?.+%./.f..[.C.......>..vi.'.h...BV...?.......9#.-........W{..c....v......oNZ.....n.U.~?+=.l..^7....a....6.......q<@..I}1-.{.E....YH...H....~Su7...@..J,.(._..B.s..t.Y..:......n.uyq..5>._..t..X.7g.....2........3./......ac.....GI....cDh.1.....G.8xpI.m[=.eJ.e_w...n<Q.2...E.E...K"....D]5...>.CG..........N.....EDS.U....<..........4.........:..\.%.wa.3.......P.R<.gD...$&...JM....~wu..4.yM.D..=..,/...O.....)/.U..J.....R..Y.}v_.....B...0...}..~j,,b......wv.wK........f&.*.e.'.;.q..$.a.

C:\Program Files\Mozilla Firefox\META-INF\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\META-INF\manifest.mf

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	324223
Entropy (8bit):	6.916891442763271
Encrypted:	false
SSDEEP:	6144:h6v5Afiy+BjL1P9lq+NaBzXTS5sZujD1MXFDc3rH:ujtPTgzXTS5s54H
MD5:	819EEA83A11E312786FE4EEA695A5007
SHA1:	E24B9479F28B6204E50130CC07A13156733359E3
SHA-256:	3C516A3FC00D5AF801C5550F5784AF8B6D311C7268022765DD421FC4393F0810
SHA-512:	15D0E63C347084AFE651D29E85BC3C8860BDB07AE0443BC5CAF368B2CBADC48EB95043790C03E5DB08B304ADC67619865EA5D71B0616AAA8ECEBE8DB562ECE97
Malicious:	false
Preview:	.h.W..7RQ..P3J^R.ow...B...K..0.R% ao.U.IoPH..q.">./. ....B... SHA256.SHA1-Digest: lHuoFcq64iBflNZTC3JaDS6PR1M=.SHA256-Digest: L3pqv/tEQz8cYLUzNIindHGe9Hh86/OgC0SLoDl7NK0=..Name: chrome.mani.l.J..-A./...OVS.&2A].r.<o!.?....vLA...1IoPH........[....`~2;MdRl1LE9f3wSc=.SHA256-Digest: qUb6sqB+1ehcMl37UEBjvuz772xZcXCll3QB0HK6uMQ=..Name: chrome/chrome.manifest.Digest-Algorithms: SHA1 .A:...Nu4.H..JVY.;\|.i.....f"..q.u.+}&..J_)mz..:....s]e..Lb>U.L/zGB69W8rzefduBjR3yPocu1dg6IS+t5gZ4JDFZUAs=..Name: update.locale.Digest-Algorithms: SHA1 SHA256.SHA1-Digest: xKsBObpw2lIlOkm1UQ.>.F..)GHasq.b...b.@W.;..T\|b..3.v..p...jxHpN...Q..f.mZ...OB.Z.HMv8A=..Name: res/multilocale.txt.Digest-Algorithms: SHA1 SHA256.SHA1-Digest: xKsBObpw2lIlOkm1UQl7wxxLma4=.SHA256-Digest: Rrpqqd._h.....)7e#G.z.8..i.y..;Iv.&w..m6~S\|.,RlkR....].?.(.;..Da%.Jnts.manifest.Digest-Algorithms: SHA1 SHA256.SHA1-Digest: vcvS8U3O17Q63WtgrIGRHnb5eKY=.SHA256-Digest: jz/iZaCNrCvc247LsA3/T/r+Y7a.@!O...ND2k&v.m.ELgQ.-...Fb..'..Nm.An.I

C:\Program Files\Mozilla Firefox\META-INF\mozilla.rsa

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	4679
Entropy (8bit):	7.921338843294117
Encrypted:	false
SSDEEP:	96:X7WF1L7MZ/eVkLAP6mxvocdx0cILU19yp62N7AJjNuybBd:iPCmxRdxVs7AJjNnd
MD5:	DCBBAD5C4E77CFE3B0548DDB89F73456
SHA1:	2EBA1275C99D0E218435989EC55419422CDE35DD
SHA-256:	A42FD6DEA3BDDC13989F1F50ED04201655CDF110B0265153358C73D7347EB753
SHA-512:	CE0A28DF9E7C04AD2158AA37ABAC87806C095B9366333613B7034B5348905DA375A06F92F803C8C3E121623DB58049067755B89E4F6B0BBED3B02CA14115C15F
Malicious:	false
Preview:	.F.D..>/.'..N.......j..]8.B.d...`...]~P\|....R.tu.h.?..S.?{q..#N.......'.$..._.....B~.c...0.PzR....?dIz.H.i.I..r...."......d..". .4/$.T..:L..........eN..+.59..R_:......{..........K.....%.(.lns.3..U;V........RI/..>Mp\|....R.tu.f............!..:..f.X.71$.c....m..).\.....0.kMe....6..M.-.i...P..jH...O..%...P.......=...P6W.%......3....SoW....SB+P.a.l....s...'...."..{..".~.5......."0T........DAm..w.#+......M.Rk'n..`..o......+.Vd.A......8..`b.....a.......l..x.y.....{WT.3..#.\|S$..r...#8X..-S7...;.v....d.....x..m.O....K<....(..p..Y&...yP.n....AJ.OB...YU.$.=$.+..Z.N..../?........c.Xt...6........./...~$^O..6<T..B....C../.6..4..h ..@..j...Z...../.........LHr....RW:N.....$.....wb.......!=.~.+6...1.g......v#...N.@....$..H"..c..E.h'].`..B..Cj..K...(."...`..6..e......c.....r.5..tB.BZ...vRGH.}..e.w.y....S".pK..+...cDW.........+.>..-c.S..e4..gT ..8Q2.._......!i'...^......i.......j.B..2\|;....&.....!....<.....C.}..L....f..iC.Q?.&.n.:.:+..'io

C:\Program Files\Mozilla Firefox\META-INF\mozilla.sf

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	458
Entropy (8bit):	6.569101683258461
Encrypted:	false
SSDEEP:	12:Wm6HjmyiM8Jncjpe5xWf34r9kSVbq/t07k/ZFs:Wm6uncjrf89kcbO+Yu
MD5:	BDFD291F2DF0A99DB5C0B914202D251C
SHA1:	9404C8ABA97A2435FA0F3BCCC034780B7D6C3CA2
SHA-256:	FDC96B1709A73F35E3CFD811D7F729857294D7E8E3E4F06FC1E49490E3A48C6E
SHA-512:	A9B483FE6BB9F49E346C1B7702987D91596DDDA5D9709B6DC4080D70D6F93526553289DFA25BC75FF729F4C95A804A5DB87172282C110363B739F9A3C78BDB80
Malicious:	false
Preview:	d..\|.ES1G.r....@.....P....r.9.k.......#...._.w..^......4...To..w..T...w".........y....7~.(6?..7...7.0e.x...A.>....{...eF/bw6X03G/rE=....:....8.kKd.^....p9.......(.....+.y7.8..u..gW..=...0Mn.R...H&H.-.6d..v....8.\.>y........g..`..l...1G.b..ba.Y(.G..+..q....lEv..S.H.N..........:.d..b..1.d..^.N.~.'.....cEF%...y..MlX...8Z...-.%..............................................................................................vux2f891j9j.

C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1101
Entropy (8bit):	7.460255557559314
Encrypted:	false
SSDEEP:	24:QceY/tAQmKFoXtwf+3hQY5EhPv0Id/KUiBZfnR:QKtIl9m+xjIdi5ZfnR
MD5:	F08061CD6A0F75465FDF991A9486841C
SHA1:	7B6A392E9E71B9C1A50CB90232A0832F5365AE50
SHA-256:	3114D38A32B34CF4A1C211E3992391C1CDC0D7223B03D2A34098A87203C1D819
SHA-512:	5CC362FD6388AD8101CDEE4AA7CD5B045041BC8C3D98A52644CC3AD94D9DBC1967AC1CC7BC78EFB6DD9C91086A5F609C9195C3BF0D8AE5013879D7CA6DDC0ADA
Malicious:	false
Preview:	.n....J.;....[..@8..6F.....Z.=..............H../+>.H...^.;..V...95'...Y}.RS6..j......:CS...........".$......47{..T...P.o.M....m.'...~..@4.+^....4.D.7....Y.......G...!7........K........Zn...Y8..I}.7.Y...>Ce..N.......J..b......<0.......s.R..s..V-....Xy..w}..6_U..?.S..........F.H......{(.B...Q.....N....j.<....{..Qy..-EW....:.\.:C.......W.....+...3.>..U...b.t..N....k-+....^..@~..dCQ....+._.2.......Q.....F............t...I....9.!...^y...y..d\Y...(CG.;........W....4....-=..S...F.w...R...x.&..Zw..@j.7.E...>CD.~.............H...41/.I...W.z.......Z./...Oh..Q}..!XS..2.^.;........E..H.....+14..B...\.;..I....9.+.h(Ft..Wa.+.B..)...1......QB..H......(c,..I....~..H...w% ...B}...m.. BQ...>CQ.:C.................",..F...W...us a crash report....^..m....!D..}..0...`Xpdq.....L.Vl.7..F.....c.=......3.?.....s..\|9..F.{h0...sd.,._...K..r...C-1l.".:..z....r...{7..1:..:.[.3+....%WU7...o.... 4Dh=.V...}..v.....&......]..`......5z[..<[...4.C.Rz....D.......

C:\Program Files\Mozilla Firefox\browser\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\browser\omni.ja

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	45598366
Entropy (8bit):	6.97441887170638
Encrypted:	false
SSDEEP:	393216:5T1P59UPw1BrHCmFbAcqI0bI6oB9ujITicCD1iFqxskDf:D59Uo1BrHJFbAE9MITi6qxzDf
MD5:	8E33DDB92B922674CF6A10FF3F96F412
SHA1:	7AAB4D716F84E1DA4169C41F8C60071095EE8B93
SHA-256:	0A900FD354AE95DEB91ABCBFCCD94CF12928BF22E47F99D3915975EE70E85099
SHA-512:	FED18C6D9F6D9C3979D6B8B93E1C0CB979590610B655FE855F6AC6C49D7953F942395E98DBE7106D2ACDF8D3C32339FE73B3894ADD6C23929E5E82767348AEB7
Malicious:	false
Preview:	....Rs.B.I..H.........'..G+.....8......-z.q.``g:....6S...n..rences/firefox.jsPK............!<...........$.............}...defaults/preferences/firefox-l10n.jsPK............!<.].........(.X...8.@.I..H......3...^.6Y.z....[.-..H.b...T...J0T?....m.......!<...P...P... .................defaults/preferences/debugger.jsPK............!<..Y.H...H.................[...chrome.mani.=..Rs.B.I..H......\sAz.F+5....8......-z.q..8f:....?....s.ImanifestPK............!<wo........................[...components/components.manifestPK............!<.-..........3.............Y..X..pW.%.+i.?....&.....4D.o....M.v..r.i....OP.../[%{.....g...!<..q........-.............w...chrome/en-GB/locale/branding/brand.propertiesPK............!<.B..t...t....................lo.9..xY.).'4.&.....%.....%Y.y....L..d..f{.e...a:...Ef.3....g....%.................localization/en-GB/branding/brand.ftlPK............!<V..E...E...2.................localization/en-GB/brow.=..`J... u.g...3..K.*{)....8.....

C:\Program Files\Mozilla Firefox\defaults\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	1438278
Entropy (8bit):	7.186245692631955
Encrypted:	false
SSDEEP:	24576:AaNNSkV9k5/AgQckFKgRBsQtiuP8lnc9enbFX3IJG0PdM7O5XPKZvAt6rkY95j:Rg/AnIgRttHincbJ3yZYte5j
MD5:	189D199501B608CD7466CE2562676CA0
SHA1:	6BF7FFFFC1FB927822CA47CD041EAAEE6F424A74
SHA-256:	F83224FA340F045A57C9B84783689EF8AC8C178BFBF97D216328C1A16E1FFD06
SHA-512:	407A24A1C425D448DA1F901739AF292ECC1ADD170AB6321E340EB2B45BD39A51D77D86104212D40A76F1426F762ED9CA62D4502B617FE352B06335CE5559CB76
Malicious:	false
Preview:	.......5S...Hk.j.n...sx.A.D.$.g.....Q5#^.....v...d....p.G.?...2Y.'4Y...l....GSUBq.........l.OS/24..........`cmap%=.l..j.....cvt ...D..v.....gasp......".....glyf...<..G....hhead.Fat.......6hhea...I...aS...cI.@x&sU.`[.A.}...E.....Q !...1{ Q....C.....G.?...z...G...`....post.$.....H..L..........z.J_.<................................................................................4S........7S....%.8.w.X.`ZxA..cf.&.6.<PFW:...gLVV..G..B..E.:..w........A.........PfEd...#...........[............... .................................................................................5S....$.8.7.v.`ZxA..cg.&.6.pQ W:...+M0V..G.....G.?..w........................................................................................................................................5S....$.8.7.v.`ZxA..cg.&.6.pQ W:...+M0V..G.....G.?..w........................................................................................................................................5S....$.8.7.v.`ZxA..cg.&.6.pQ W:

C:\Program Files\Mozilla Firefox\fonts\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\gmp-clearkey\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\uninstall\helper.exe

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	982186
Entropy (8bit):	6.2240167947427585
Encrypted:	false
SSDEEP:	12288:9MWkjkn6ppukgfs2Ly5XHG27QUytpq8tA0TJGNNDL3HPk31uaeSaXW/ZRfDU1YO:9+2Uy7Sebamx1DUx
MD5:	F25F1CF7D571AE644CF6DE3C53893CBB
SHA1:	B268D26946D381F777B875A49C389FE4B08296E1
SHA-256:	354189053C72C2FFE1C0A8D87BA47DCD1F1C6A46E2AB2C98B1D4B4A519F963D8
SHA-512:	880C96DC8527201D6D23F922D3D9C53A6FCA09CA7A1DB7EC3CD31270DAE4ED817AA984A4B3D6BBBF1353C40AEB7FA59C1398179D3B14E48B189D306AA09CF69D
Malicious:	false
Preview:	...'..,.....T..r..}...z:.....s..2b....Q..?.i.....s...IB.6.o........!..L.!This program cannot be run in DOS mode....$........1..P...P...P.._...P...P..OP.._...P..s...P...V...P..Rich.P...\'..,......Q.N]?G.}....z:#....u..Tb...Q..?.].....s...IB.6.o......................................@.............................................Xq............................................\'..,....U.T.q.r..}....z:....s..0b....Q..?.i.....s...IB.6.o.text....d.......f.................. ..`.rdata...............j..............@..@.data..............................@....ndata..."]'./....U.T.q.r..}....z:C...a.s.2b...Q..:.i....}s...IB.6.o....@..@..........................................................................................................................\'..,....U.T.q.r..}....z:.....s..2b....Q..?.i.....s...IB.6.o..................................................................................................................................\'..,....U.T.q.r..}....z:.....s..2b.

C:\Program Files\Mozilla Firefox\uninstall\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	588
Entropy (8bit):	6.649896174283148
Encrypted:	false
SSDEEP:	12:OCKxtwIkDfyS+BoGUdoP7paJrOshAGZes0eReEMTV0XaOC:gbwIkDaSpGntaJtAGgsETV0X2
MD5:	C4D3866D2FBF561D84E0F4C36F90EB3F
SHA1:	90B2BBF55562B63615953A9DE8DD5BA5252587A9
SHA-256:	1A7351ED709B015F162E56291555E3E3A0573801AD033F4EE4B4C84526148D1F
SHA-512:	F24D726BED16B7951E7973670B6237298D6B2E96D1363A5DCB4686AC07D055E7BFE082BB1B7ECD550150F79B2D8D8108E82BEB8D6AB983AB5509A3AA4A4844EA
Malicious:	false
Preview:	9U..F4..[....X..B..7.I.'.M4...o8.K..k.~......w..<.aK.....^J.....uF...[..U.Q..Z..7.I.'...4...o..l..k.~.....w....kK.....^......kF...[..'.$..a.7GI.'..4...o..p..k.~....i.w....zK.....^Q...._F...[..9.e...!.-7$I.'..J4...o..w..k.~...>..w..7.aK.....^Q.e.d.=.t.r.u.e........f..%.be=2..r......Q.Xs...h....}<..l.....,p.evb..`.Z ...1."/.'..v.wI93....fn.\..y.....Q....3.2..n..<.p..v7...8.....a..&.jyt.d.../5.}.;......a..o<.k.t.UW.d.Wp..[;.._}.....cC6y...j..*.%..&.;.4W.............................................................................................vux2f891j9j.

C:\Program Files\Mozilla Firefox\uninstall\uninstall.log

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	3458
Entropy (8bit):	7.7665302730891215
Encrypted:	false
SSDEEP:	96:cKu0y8I4/GrAvrn3cpxz86F/hI8NarRK6:c70y8z1D3o86F5I8N8RK6
MD5:	82F02ACD94A6FF533289AB0E95726F98
SHA1:	F6AB354E93687A60F8C49699F2BDC67F56A1595B
SHA-256:	71FDF694835F1DD6C5DD3AC314BB82A90F12A1A3DB6E5DA4CFD262E04D8BB0AE
SHA-512:	69DC8C50E566C0479989D46F8132A0945CC72E380E28CE147E74AC4C606D0D44B9EC19190C5DA16BC5E69DEAA9CCDAB9B6253D02408172EAAF70518AA9B6A89F
Malicious:	false
Preview:	L..K..c..s....f........7L.(@..e.....[.Xd.A..0.....Y.....Ty..L.Dr5.c...^`..3.....~\|.b.....w..F..v.Pi.A.Ie.....Y.!........^..R'.g....k.......l..?P.....$....3.Wp...Vy....G......Xp..G.O.8.=.\.^`..3.....~\|.b.....w..F..v.Fr.G.V'.....F]@......n..#.gV8..-..mZ.M.....1R.?....-.SF...=.Zl...L8....\]A......i..K.UV9.j...]hF........S.{...a..F...d.X-.V..7......]......]..G.D.t.q....wZ.W.....=O.d.....1.SF.....;..M.@n......X.......C~..@.HM;.}...]hF........S.{...a..F...d.X-.V..2.....A.A.....:..B.,5..\|.K.,e.........sC.fM..-.SF...=.Zl...L8....\]A......i....N\5.u...]5Z.......7L.(@...-..F..>.Dt.I.Q<.......^H....Xf....@O=.}.\..jZ.L.....7B.f.....1.RE....pi.A.........E.....z..X.UZy.!.@.@..R......d..s....-.....g.Fr.G.V'.......^H....Xf....@O=.}.\..jZ.L.....7M.?.....0.....U.Ze...D$...\.......En......e. .....}.W......I......-.....a.Xg.H..e....8zj.....mk....R.#.~....)..S.....s..v....i..Q...c..m...L:.....A.@......'....ES8......>W._......I.\|N.........

C:\Program Files\PCHealthCheck\af-ZA\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13034
Entropy (8bit):	7.425977709389456
Encrypted:	false
SSDEEP:	192:oRbBSWj0TZL0WYjwIoipo6WkX3vWVZEoun0DvUrKYaL2O0T1MU53z0qVzr:aSWWZLXIoi+MXM5u0LUr9T1MUloqd
MD5:	D12236000BF4746DA327DFA126B47D1E
SHA1:	02940460F388C568B5BBCA481EE8C231B4DD2F09
SHA-256:	D71C168D3EE9B0D9198897754F83BE2414F0DA7CACFAB5920DDED87206439A61
SHA-512:	73551A0E7538AB4A118678DEC24706C3CB329A6160F3F1D6B2AA8CD0CD74EF43BEE25F8D170178096B728DAD88FB9DE12881AD8E400F8FC62CCDDF170D34282C
Malicious:	false
Preview:	........!LM"j.:/=f..r.v ."9.--d7..C)"w....4~.V..d.}.4..\|D.o...........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L...&.=.....%LM"u.8..g...r.v`."9.--d7..C)2w..o.4~.V..t.}.6..zD.o............0............@.......................................... ...................'...........................................Pm.....%LM"..:/.f..r.v`."9.--d7..C)"w....4~.V...a.aU...D.o.......................@..@.rsrc........ ......................@..@......Pb........T........................rdata......T....rdata$z.*......%lM"e.:/.....V.G`."9..-d.C.P...[..~.V..d.}.4..\|D.o....................................................................................................................................Pm.....%LM"..:/.f..r.v`."9.--d7..C)"w....4~.V..d.}.4..\|D.o....................................................................................................................................Pm.....%LM"..:/.f..r.v`."9.--d7..C)"w.

C:\Program Files\PCHealthCheck\af-ZA\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\ar\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13034
Entropy (8bit):	7.473665010509162
Encrypted:	false
SSDEEP:	192:tmTTdXW4TOghWYtI09Ioz3WvW/BDCajbWetiGLU1Qrqoe69E7arl65CGg8vNQ:eXW4TOg99Io1DCa7LI1SHEerl65CGg1
MD5:	C4470CE74CE7B00715624F9302F5692D
SHA1:	88AA485369ACBC5F4EA81EC0FEE37439B2031CDF
SHA-256:	B5400C8D26A83E0BEFBFD4F9030A0A574817C2074C4EB1CA838F35654F579C9C
SHA-512:	9895EF80D1B4FFFA8FC2FBD18B713AAF8E276D32707628D6706437921F7A0D3162952B7EFA8310CD0C5FE4CDE88137C72C84B89A3E9E1A83C05DD4109BF86BD3
Malicious:	false
Preview:	?]h...lZ....`..\.7..Q.Ja.+...y.2.5c....7A.t...5...a.^..P.............!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L.......l^......%..9..Q.J!.+...y.2.5c....'A.t...5...a.^..P..9...........0.......-....@.......................................... ...................'..........................................r.....l^...q.....7..Q.J!.+...y.2.5c....7A.t.........^..P..9......................@..@.rsrc........ ......................@..@......Pb........T........................rdata......T....rdata$z.}.....l^........D.iu.{!.+.98y.=6.5M....q.t...5...a.^..P..9..................................................................................................................................r.....l^...q.....7..Q.J!.+...y.2.5c....7A.t...5...a.^..P..9..................................................................................................................................r.....l^...q.....7..Q.J!.+...y.2.5c...

C:\Program Files\PCHealthCheck\ar\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\az-Latn-AZ\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13066
Entropy (8bit):	7.458759518625335
Encrypted:	false
SSDEEP:	192:Tw4wMw9YKS4ZL+6WACmgIoy5ZBWovvWnkSujcjVjq2A1YDQ0kNNttrErK+Lv5riY:89RJS4ZCzZIocvukFcVArRNNtBIn5+8
MD5:	9ADADEFCEC73FEBDE4ED8572FE83F03C
SHA1:	B81B7D4CCDEE3C12A3E447286B8531B64FA2CD7D
SHA-256:	36DAF1C84B8B250B05013B529CF8B51E89A4A7ED7D853DBB4AEF9792137759C4
SHA-512:	C374B60BF49046BC4C1A2D4574704DB19531503948365FA0DCCD6B7553D95FDD9FE142D2CD01C828985E33113D49275340834845D93DE59B777787631E083CB6
Malicious:	false
Preview:	.e._V..\...VF..[L.5.&. .\(."%.w8......;../5.9]KQ./.M....Q'\.........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L...=.k=U..\...VY7...M...&. PT(."%.w8......;../5.9MKQ.-.M.....'\..........0......?.....@.......................................... ...................'...........................................?;_U..\...V.7...L.5.&. P\(."%.w8......;../5..//0.N.M.....7\.....................@..@.rsrc........ ......................@..@......Pb........T........................rdata......T....rdata$z.E_=2..\...VI7...>.G....P\(o.%.<......../5.9]KQ./.M.....'\..................................................................................................................................?;_U..\...V.7...L.5.&. P\(."%.w8......;../5.9]KQ./.M.....'\..................................................................................................................................?;_U..\...V.7...L.5.&. P\(."%.w8.....

C:\Program Files\PCHealthCheck\az-Latn-AZ\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\bg\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13034
Entropy (8bit):	7.468372513957149
Encrypted:	false
SSDEEP:	192:RW6EQZZHLWMcAyMBIovvF0WJbeMDW7juRNgy9Vw1ZKBrWorZfhIKRSzpQ7:RWsZHyIIoHFXeMYjuX9Vw1K9ZIKRSzS
MD5:	F98E556EEE811C79E4A4DA0D260491E2
SHA1:	C8FEA4D2670AD848F004D315FD24935D9A05654A
SHA-256:	8C4BA39FF72A19AF70D5808B0410B717FF0A01CDA87F59540FF8C19D88632249
SHA-512:	FC19B96F91B5C27CB8550AA5EA65C4540A2E99569B52AB68D75CFC4B1B7D4F39CB2C57FF17532D1B9BBA19D2F71B6922C0A4F2732B6D973ED2569B475D0190C2
Malicious:	false
Preview:	BZR.S.].....n.....A...u......\.V. .n..KV............... .eT:..........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L.....oP.].....qS.<g.O...u......\.V. .n..KV............... .e.:...........0......U.....@.......................................... ...................'..............................................P.]......S..l.A...u......\.V. .n..KV.........b`x... .e.*......................@..@.rsrc........ ......................@..@......Pb........T........................rdata......T....rdata$zuz.o7.]..#..aS..B.2..E.....#\|.Vm$.n...95............... .e.:......................................................................................................................................P.]......S..l.A...u......\.V. .n..KV............... .e.:......................................................................................................................................P.]......S..l.A...u......\.V. .n..K

C:\Program Files\PCHealthCheck\bg\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\bs-Latn-BA\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13034
Entropy (8bit):	7.437273982617917
Encrypted:	false
SSDEEP:	384:y1OuuyAaWbZn85HIoIx87zkmYrbYHrgW8/My0suf:MnAvq5ooIIkmXHrgW8/HU
MD5:	75BC523F0D15C7EFC74B2CE2F5B14298
SHA1:	34B043EA57F1C9265EE9DC1197D1F82A13DE4090
SHA-256:	915F33BE35A29C5CF77480A10662795AB261029CEE93C66B5FA0CC0349E5D049
SHA-512:	600C7567399CE7D6125F99D9FB0434F874C5DCEBB8B4C71A785E55AEEAA00C0AD23618A982F3BB13C9DE883FE9349869792C45ACA8FFFA8C12E94F26E0485EFE
Malicious:	false
Preview:	,C;..e...j..a.#$.O..Q/uR.w.X..vC..l{.t..K..U6"..u..wf.:..4o...........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L.......e...j..~v!..N..Q/uRG..X..vC..l{.t..[..U62..u..uf.<..4............0......[(....@.......................................... ...................'..........................................a....e...j...v#$.O..Q/uRGw.X..vC..l{.t..K..U6"...k..f.J..4.......................@..@.rsrc........ ......................@..@......Pb........T........................rdata......T....rdata$z.c...e...J..nv#$!=t.2.EcGw.Xe..v...lU....o.U6"..u..wf.:..4...................................................................................................................................a....e...j...v#$.O..Q/uRGw.X..vC..l{.t..K..U6"..u..wf.:..4...................................................................................................................................a....e...j...v#$.O..Q/uRGw.X.*.vC..l{.t.

C:\Program Files\PCHealthCheck\bs-Latn-BA\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\ca-ES\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13570
Entropy (8bit):	7.434982280241575
Encrypted:	false
SSDEEP:	192:XzBWsbOR3QOWEEexczSGkHTZWfBiT6MtcVTYCHu4Lo4vuMlBtcRA0e12DE9/O:XdWsbOGAEEcz8zLTLtCS4LTvB1022D8O
MD5:	49C0E30B4C433F8B18CCF7A6F634B98E
SHA1:	B6DEDE76F2A3B26D676655994799C2C37053CC01
SHA-256:	D38093D93446BFCCC66197B022C1DF37191C57A8C87750E03F150B597EF2EDFC
SHA-512:	D9EC3242B651A0B4E570292C19A686602DCA0F0C898CFC42C13D60ACFD5112A572B4B09909CAFFE02F68F66C9885707B740DC03FCA3A84019F5F268ED52E18DA
Malicious:	false
Preview:	....}W^.2...i.&.`........8.9h.N..&{..H...F...[~\......k.>...........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L....Cn~W^.6...v.$..........2.9h.N..&{..X...F...K~L......k..............0......y!....@.......................................... .. ................'..........................................CM..~W^.6....&..........8.9h.N..&{..H...F...[P..v.....k.........................@..@.rsrc... .... ......................@..@......Pb........T........................rdata......T....rdata$z97wn.W^.68..f.&..{......8.9..N..#{.!:w..+v...[~\......k.....................................................................................................................................CM..~W^.6....&..........8.9h.N..&{..H...F.*..[~\......k.....................................................................................................................................CM..~W^.6....&..........8.9h.N..&{..H..

C:\Program Files\PCHealthCheck\ca-ES\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\cs\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13034
Entropy (8bit):	7.43775393192145
Encrypted:	false
SSDEEP:	384:zfiZZ1FIo+bkHe1mGCGZYDgu9rIY3ATlRhDApR:m1eosseJ+DgNY3AT50
MD5:	3B34EDC8E707A0033A04A3B92D0CCACA
SHA1:	1BE176F0974B2FBFEEE4A330FDB8BE744147E77F
SHA-256:	88DC45FBB5F74E29708427DE23CBD8D41A2CD00EA2B9E26FC54695A89C183C74
SHA-512:	18FE12FB65E326F6102C9362C92B7F6F23A0CBB314476E0E941516163534ABDC04B9A4315E373041E36426113492F1DC04E300839BBFF912CF3152899A9A1B6A
Malicious:	false
Preview:	..b.s..%.".V........7.3.q.....+..#...Y.... .% ....@."..Bz............!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L...oC..p..%.".V....%...7.3.1.....+..#...I.... .% ....@. ..Dz.o...........0............@.......................................... ...................'.............................................p..%.".Vg.......7.3.1.....+..#...Y.... .% ..~a!.C..2z.o......................@..@.rsrc........ ......................@..@......Pb........T........................rdata......T....rdata$z......%...V......dT1..1...0.+..'...+.{.....% ....@."..Bz.o.....................................................................................................................................p..%.".Vg.......7.3.1.....+..#...Y.... .% ....@."..Bz.o.....................................................................................................................................p..%.".Vg.......7.3.1.....+..#...Y..

C:\Program Files\PCHealthCheck\cs\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\cy-GB\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13034
Entropy (8bit):	7.439338084990116
Encrypted:	false
SSDEEP:	384:yu+cWgfOKeIoI/TCP/H1jLORiMwvyQzKiz4S:ylafOUoI/Tk/ZORAvyQz14S
MD5:	17942DB75C057F2C1D997CDFA9EEAF75
SHA1:	03C2BD4AAC24AC907294DB57517ECB2F66D7B792
SHA-256:	D7B76A65F072B6108139054A816A92FCC88C89F19C7A92641BF08187A89C4D5B
SHA-512:	C9C6EAD36F07A006A24ED9670E8F842959F722DDF381AA75D8DEEC4DE6909C45D4B2946F1F772288D0FCD5A4911DAE2485E034041CB44423DFF2FB6CADD5EB7B
Malicious:	false
Preview:	I..N.mh..../.>.u.<......xM6T..Vn..)......\|X...g.ca1.k...a...........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L....V#,.mh..../...T=......xM6T..Vn..)......\|X...g.cc1.m................0......Q$....@.......................................... ...................'............................................sN.mh..../H..u!<......xM6T..Vn..)......\|X......1.............................@..@.rsrc........ ......................@..@......Pb........T........................rdata......T....rdata$z~..,.mh..0./...u.N......xM.t...j...u......\|X...g.ca1.k.........................................................................................................................................sN.mh..../H..u!<......xM6T..Vn..)......\|X...g.ca1.k.........................................................................................................................................sN.mh..../H..u!<......xM6T..Vn..)...

C:\Program Files\PCHealthCheck\cy-GB\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\da\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13034
Entropy (8bit):	7.437312191494973
Encrypted:	false
SSDEEP:	384:mOjhhO9W1YZnw8IoJereSIxH9CXdFggkAR8ShVmtlJb:mOjhhgJeoJ0eSOH9CPggkAR8th
MD5:	0B830A66A98AA9919E738D30136F0988
SHA1:	567FDB07F618ED5E85ED41E42FF176002150138C
SHA-256:	2806DEC39989914BC455AB15B28362B1DE67E1BA96C6CAC163055B93DD8496CA
SHA-512:	08D4F23BBA53092B6D64DA892FF7DE6BCB588CF23E16EEABC8DC984B27236A274F5682A49932679E7B34DE83B8D4FE3E3EEA7B28C249B22364C738517251DA12
Malicious:	false
Preview:	.z..}p..T.Vx..8..+.B.....,.z..H^.(h.......].[.7...g..S'}.\Vd)........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L.......}p..T.Vg...%.0.B..n..,.z..H^.(h.......].[..'...e..U'}..Vd).........0............@.......................................... ...................'..........................................Y S..}p..T.V...8..+.B..n..,.z..H^.(h.......].[.E..h...#'}..Fd)....................@..@.rsrc........ ......................@..@......Pb........T........................rdata......T....rdata$z#Z7..}p..t.Vw..8...Y.f..n..,qZ...Z.(F.....].[.7...g..S'}..Vd)................................................................................................................................Y S..}p..T.V...8..+.B..n..,.z..H^.(h.......].[.7...g..S'}..Vd)................................................................................................................................Y S..}p..T.V...8..+.B..n..,.z..H^.(h...

C:\Program Files\PCHealthCheck\da\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\de\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13058
Entropy (8bit):	7.436717869156419
Encrypted:	false
SSDEEP:	384:3dCbWaZL9IoMw36ycfh/Fx2b4tcLZWLPJyS:3dOtmoJ5Sh/Fx2bxLZ0PN
MD5:	3BB68114CA3322136EC522560D084CB5
SHA1:	05F51420BF27E0966FB9719F8C1B9F7F93AEE71D
SHA-256:	0306ABD20A41E17A513D6E9952E7D44F355A822C9D7513FA5307EB85466F862D
SHA-512:	A972AEC088BA43B609F5D492F97C455CBFBF7294FB84D7B94716D5D3C1CB5B8689E1F75BC44FF7998C485ED291A047F230918A988778FBBBD6E26889B5A5D736
Malicious:	false
Preview:	...N7..db.......&p...u..BQ....aU..@....s......=..^ea;3x\(.4C........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L......,4..df....".).q....u..JQ....aU..@....s......-..\ea=3x\..4C.........0.......[....@.......................................... ...................'..........................................D.WN4..df...O"...p...u..BQ....aU..@....s.....#O...?eaK3x\..4C....................@..@.rsrc........ ......................@..@......Pb........T........................rdata......T....rdata$z>.3,S..df/..."....~..8E%.BQ.~..a...n..q..C......=..^ea;3x\..4C................................................................................................................................D.WN4..df...O"...p...u..BQ....aU..@....s......=..^ea;3x\..4C................................................................................................................................D.WN4..df...O"...p...u..BQ....aU..@...

C:\Program Files\PCHealthCheck\de\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\el-GR\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13058
Entropy (8bit):	7.4883765327764165
Encrypted:	false
SSDEEP:	192:dArKSCu+4QZfd6rIWMMdkIodoWQgHrWswoNNCjs5RO8gekTfan821vdq6/uDoq0:up+VZfohuIorHdw7js5gZTi8+q6mDx0
MD5:	13CA6F666EE20AD73F052C7A8A46AD98
SHA1:	7BA779331A4B04AF85AA3F86A77B928C906B8D2C
SHA-256:	7A5663F3A7F85F151D93DDC7E012B6A40776A7C91E7040EFDF3C895C196ECAF5
SHA-512:	52554114F3F17F158F1F50C6DB093ED6D6469D6A0C392DE7A3B9DE520F4FB83BEA2C501EC000DF8C58E7F0FB6A441715A57AC4539FEA56A7F201EA503F312A25
Malicious:	false
Preview:	.e....nS..q..D.OP6A.T..7.H.......:p..20......W...?+0.X...k.........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L.....)....nS.......AK6A.T..7.H.......:p..20......W...?+6.X.N.k..........0.......6....@.......................................... ...................'..........................................S?y....nS.......OP6A.T..7.H.......:p..20.....3...?+@.X.N.k.....................@..@.rsrc........ ......................@..@......Pb........T........................rdata......T....rdata$z)E.......NS.......<"Ue.e..7.......I.x.........W...?+0.X.N.k.................................................................................................................................S?y....nS.......OP6A.T..7.H.......:p..20......W...?+0.X.N.k.................................................................................................................................S?y....nS.......OP6A.T..7.H....*...:p

C:\Program Files\PCHealthCheck\el-GR\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\en-GB\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13058
Entropy (8bit):	7.47057063633846
Encrypted:	false
SSDEEP:	192:WeYWm3iWSOalWUD2Y5IoHi5WV7AycQWpS4acQ9/UuVsk4hTU/QIhfeOmIaiRr:WMmyWSOUIolbcntG/Ug4hI/NfeOmwx
MD5:	2BF066C13B78BBC9399EC5C548CACA93
SHA1:	CB0A3C55722BFE0520678FAA68182E25BB7CAF2F
SHA-256:	FD8E32D3030E7EAD3F08BE339EB638612663E25B6E7A1C92AD6F5785AB9186E9
SHA-512:	9AF6FB28C987ABB890A51299EAED6D6F7B88460867EB842CA917BC2A90379B8324C0C8F210CA1AFA1412D21F5E0D9F718A96A5781041CD94738579A1173322ED
Malicious:	false
Preview:	\7..I...J..8..`..&B..N..6P..v...D.}.BC..Fp......6U..S..t...V........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L.....4.J...N..8..b.{'L..N.C>P..v...D.}.RC..Fp......6U..S..t.U..V.........0.......u....@.......................................... ..t................'...........................................md.J...N..8v.`.p&B..N.C6P..v...D.}.BC..Fp....W!.S.t.U..V....................@..@.rsrc...t.... ......................@..@......Pb........T........................rdata......T....rdata$zk...-...N..8..`.^T1...~.C6P..V..g@.}.00...vB......6U..S..t.U..V.................................................................................................................................md.J...N..8v.`.p&B..N.C6P..v...D.}.BC..Fp......6U..S..t.U..V.................................................................................................................................md.J...N..8v.`.p&B..N.C6P..v...D.}.BC.

C:\Program Files\PCHealthCheck\en-GB\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\en-US\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13034
Entropy (8bit):	7.464065553633382
Encrypted:	false
SSDEEP:	384:3muWyJOzIoMEviTvADFLiDRvBX4qpZ62D:3mCJOUoFAvAxmRvBtD
MD5:	A29601CE49AC40A8EF6794761FC2B077
SHA1:	C8FC678223375B42F85B027091B58D55A45F84B8
SHA-256:	2ED02DFD268CA1DD62F36F7404E13EB76723435D3B1F486B93884D547A0F1291
SHA-512:	C76DA2DC7385F543748C154CD3EE65122A39A8ED5FF05812D0B789188FA9E3C3D70E5198E39831A37DEC908A5FD8E60B3513C4F3D504D7B9A3BBF2C705594398
Malicious:	false
Preview:	.x(.D...{.Z~?...B..._Zlu../.1.............7.......]n.`N..Ys..........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L...\|..G.....Z~ o.....5_Zlu../.1.............7......]l.fN...s...........0...........@.......................................... ..t................'..........................................."..G.....Z~.o......_Zlu../.1.............7.....i.)...N...c......................@..@.rsrc...t.... ......................@..@......Pb........T........................rdata......T....rdata$z.X. ....$Z~0o...v.\<~\D../.....#...<.....7.......]n.`N...s..................................................................................................................................."..G.....Z~.o......_Zlu../.1.............7.......]n.`N...s..................................................................................................................................."..G.....Z~.o......_Zlu../.1...........

C:\Program Files\PCHealthCheck\en-US\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\es-MX\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13034
Entropy (8bit):	7.439431958498165
Encrypted:	false
SSDEEP:	192:muENaoZsM92WqP1OIbt2oIo/aW9P3RywWRLiVFtVw/Mm1MqG6IhgSrT+:m5NNZsMMnt2oIod3yLAVuMMMqGFh5T+
MD5:	AFFE914313BBCFDDD4E52D525D5478F2
SHA1:	FACDF23A7D2FDBCC979B55E86EC0D24B1406F27A
SHA-256:	9C29B07A65A92EDE85CD89253D5146D47B5097E846C9BCBB466EC5B90D2D2867
SHA-512:	9ACFFB10126CD125737F19C86ECAFF9AC3943C6EF1BA0B92ACE27986FA61F26211B6FF387C6AAFA6B0BCC5CED82D804EA9835E98300F410CD6B71235F90E87FC
Malicious:	false
Preview:	.k\..gG?.-I.rOu..)....Ze.i4...Z\..(...^.J..\..".S..B...a.)-.........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L...7.f.gG?.-I.m.w...'.....m.i4...Z\..8...N.J..\..2.S..B...a.)-..........0.......&....@.......................................... ...................'...........................................1...gG?.-I...u...).....e.i4...Z\..(...^.J..\..P.2.B....a.9-.....................@..@.rsrc........ ......................@..@......Pb........T........................rdata......T....rdata$z.K.fmgG?..I.}.u.=.Z.....e....&_\..Z..wz.x..\..".S..B...a.)-..................................................................................................................................1...gG?.-I...u...).....e.i4...Z\..(...^.J..\..".S..B...a.)-..................................................................................................................................1...gG?.-I...u...).....e.i4...Z\..(..

C:\Program Files\PCHealthCheck\es-MX\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\es\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	13058
Entropy (8bit):	7.441758060132683
Encrypted:	false
SSDEEP:	192:gij1GkZ3GjWEbv4kzIohvKbWveK+gfnWfRgCRYLamy/q/2T5akuYi+nH+OkOjnu/:LRrZeDDIoU0eK+uuXRek/q6uYfkOjnu/
MD5:	44AEB24AFE02FAAF070BE3821DEBC7CB
SHA1:	2B68F0EEA366F057A3052476E4DA7FB053203E6A
SHA-256:	8F5AD59689C2F40F0E2A9A53BDE452C65661D166512DC2336BE6CB847A05DDBF
SHA-512:	F5B37D0B1E58866A861A82A580BFD6C7204745E297BEEB0930783E3A410ACC2803AC0633338A151E0DDDF5FC87B2577DE6A0EA51D430D7FE9D1D996ABD939FA6
Malicious:	false
Preview:	....Z1).......F)...j.......vxN....W..j.C..8D....W/..f..a........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L...O.d.Y1).....H...G'...j......vxN....G..j.C..(D....W)....a.........0.......v....@.......................................... ...................'...........................................O4.Y1).....H...F)...j......vxN....W..j.C.=J .m..W_....a....................@..@.rsrc........ ......................@..@......Pb........T........................rdata......T....rdata$z.5P.>1).....H...4Z...[......hrxN....s.;j.C..8D....W/....a.................................................................................................................................O4.Y1).....H...F)...j......vxN....W..j.C..8D....W/....a.................................................................................................................................O4.Y1).....H...F)...j......vxN....

C:\Program Files\PCHealthCheck\es\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\et\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13034
Entropy (8bit):	7.455404905553149
Encrypted:	false
SSDEEP:	384:IWsZlCyGIod8v9nIzFtvLk42s85b4GXfp/:Kb51ow9oFtvIC85bPp/
MD5:	366D1F3131AE6CA3ED42A5AB5FE106DF
SHA1:	5D39A3B716E7BBB922FE6978A79C34FAFD80023A
SHA-256:	34ABC53373A60CA83BD6F629BBFBA29E16CFA2383F92B52BF3C1A26675F038B3
SHA-512:	D6AB082CC2F628E6C97F1EAC46A72EA8AFB72FCF1C89EA821369447EDE732B197F66A6968E16B837C9EE46DC6F9FE938DEFDB83D5243A90E1E58690B2A41A8C5
Malicious:	false
Preview:	..".Q4....Y..4.t....\...8.. x........J.,..u9.S$...u7.v3....#........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L....y..R4....Y...U....\...0.. x........J.<..u9.C$...u5.v5.....#.........0............@.......................................... ...................'..........................................N...R4....Y.8.t....\...8.. x........J.,..u9.S..t..V.vC.....#....................@..@.rsrc........ ......................@..@......Pb........T........................rdata......T....rdata$z4...54....Y...t....x.>.8...X..z.....8..'.u9.S$...u7.v3.....#................................................................................................................................N...R4....Y.8.t....\...8.. x........J.,..u9.S$...u7.v3.....#................................................................................................................................N...R4....Y.8.t....\...8.. x........J

C:\Program Files\PCHealthCheck\et\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\eu-ES\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13034
Entropy (8bit):	7.430916076176503
Encrypted:	false
SSDEEP:	384:/2BWOZVts1KIoxiNDGv7zBirlHFDozm2RAq:eldsro0RGv7zBGlHFcz8q
MD5:	32F7F44C40522B623989863951EB396E
SHA1:	E73587B626173E2404BC9513B2C7E4D6CC0CACA4
SHA-256:	93BB98F91D86FBE6A69BDD7FE7CA5108E9B1452FAF023CD482E23D5D09FD0A0A
SHA-512:	16983AB4F6A9B3F2D03AAFA22BD006F11E9933EC2199095A7A1D4E096914B4DE81DF6E1FA3DB85609AB6C2BC10D4C79753488D285149FF38A099296A1D2CD44E
Malicious:	false
Preview:	...[.W.a\.W.....+9..8,.........E.g..K..7.S.=OK.1mE+.=.').. .V.........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L....B.9.W.aX.W..'..8..8,.........E.g..K.7.C.=OK.!mU+.?.!)....V..........0............@.......................................... ...................'..........................................c.~[.W.aX.W..'..9..8,.........E.g..K..7.S.=OK.1C7O..\.W)....V.....................@..@.rsrc........ ......................@..@......Pb........T........................rdata......T....rdata$z...9.W.aX.W..'..K.[..4.....*.E.c..e..E.w..OK.1mE+.=.')....V.................................................................................................................................c.~[.W.aX.W..'..9..8,.........E.g..K..7.S.=OK.1mE+.=.')....V.................................................................................................................................c.~[.W.aX.W..'..9..8,.........E.g..K..7

C:\Program Files\PCHealthCheck\eu-ES\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\fa-IR\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13034
Entropy (8bit):	7.452050390939411
Encrypted:	false
SSDEEP:	192:MJFE/SEOLWOO1mWpe7aBjIoePGeWPnMJHTWudBk0stx2tR0aEn4LlOp9jWtD/5:MJFzWOO1DFIom+MJHPjwxC0eLlCVWJB
MD5:	7732073CDE660DDB9D1B91BC37397F6A
SHA1:	E4ACAF575C3C7346C00493F1BB2C9EC5AE1A7332
SHA-256:	D1918D654A4E1C414373E0679FEB90A4F0AE018DED7DEF759A11E7EA19FF7604
SHA-512:	F4EDA8E1E7C919385837015C1D8AD2CDC3AAFFDA763FEE333823D483A758F8C73F3415E8A1A9BF0E80104713A4E234363789E05A2CEA6FA1EDCC2B2726406B83
Malicious:	false
Preview:	..<A0...K).]..Y.v...'....-.o.....>7d..!..Tm..t...NvCC..%e.;<........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L......^B0...K6b_.kX.m...'....-.o.....>'d..!..Tm..d...LvCE..%..;<.........0......}.....@.......................................... ...................'............................................<B0...K.b].`Y.v...'....-.o.....>7d..!..Tm.(.f.x/vC3..%..;<....................@..@.rsrc........ ......................@..@......Pb........T........................rdata......T....rdata$z..^%0...K&b].N+...........o.~....E...'.Tm..t...NvCC..%..;<..................................................................................................................................<B0...K.b].`Y.v...'....-.o.....>7d..!..Tm..t...NvCC..%..;<..................................................................................................................................<B0...K.b].`Y.v...'....-.o.....>7d.

C:\Program Files\PCHealthCheck\fa-IR\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\fi\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13034
Entropy (8bit):	7.441907185963777
Encrypted:	false
SSDEEP:	384:VkYWRZqPiKIopqEHxdVR1YYQh2fIlT4Ka:VeYMotH2fkQu/
MD5:	B244284326E920EF9DA725B72C3B0D9A
SHA1:	2EE8D7CF29C9A73C53890967057CB495A9EA5E6F
SHA-256:	DA05286941F4C0F4B6E2F325352E47B3FC9B00F8CC02BB6C8A1050C9899A648D
SHA-512:	5980593EF1CCEE2F0D1F65CE98A592EF2E082848D0E5F30D70780566937DCBD40A4361E05A2D3A66466B9DE8CB169704B806D5362574D2748DE2BE399EA77561
Malicious:	false
Preview:	.z.....Qw..F..j...L<..s...lE0.;C.....Qf7...E72....F.I.y.".........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L...Z..g....Qw.4D..k...L<..{...lE0.;C.....Qv7...E'2....F.I.y~"..........0.......q....@.......................................... ...................'..................................................Qwt4F..j...L<..s...lE0.;C.....Qf7...E7.{.....F.I.y~2.....................@..@.rsrc........ ......................@..@......Pb........T........................rdata......T....rdata$z...g....Qw.4F.!....h...s..ILE0{?C..bn2B....E72....F.I.y~".........................................................................................................................................Qwt4F..j...L<..s...lE0.;C.....Qf7...E72....F.I.y~".........................................................................................................................................Qwt4F..j...L<..s...lE0.;C.....

C:\Program Files\PCHealthCheck\fi\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\fr-CA\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13034
Entropy (8bit):	7.443695144611167
Encrypted:	false
SSDEEP:	384:ETkCXYwZHZI1IojtPuX9j5VH+BNHYKdWYVGNRWB:u1HiOoZINVHOHYK/Vcq
MD5:	0B9CA15A1132219ADD5EF38EA8DB65F7
SHA1:	CD539025429F0915E9F8BFB8B3B0DE57FC5FE815
SHA-256:	0F8732B39A050D43C2A29AB8FB606D40754D6565995024F89949E660C63AD128
SHA-512:	7AF126C2D65FCDCDF5993B6BD6B9252FF854ACF47CD70B63DAC6942477C471927FEF5AD3A42C0860019108B0BE09C616C0E67E823C7AB8F3DAD7FD218C6F2CAD
Malicious:	false
Preview:	.PP3h.@3.....!.1...........3...7y...q.n=.w.Z[.K.s..Q...R"gP.v........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L...4.Qk.@7.....#.......Z...3...7y...a.n=.w.Z[.K.s..S...R".P.v.........0......GY....@.......................................... ...................'.............................................3k.@7...h.!........Z...3...7y...q.n=.w.Z[.e...b0....R".@.v....................@..@.rsrc........ ......................@..@......Pb........T........................rdata......T....rdata$z.p.Q..@7.....!.....6..Z....*...}..6...^.G.Z[.K.s..Q...R".P.v...................................................................................................................................3k.@7...h.!........Z...3...7y...q.n=.w.Z[.K.s..Q...R".P.v...................................................................................................................................3k.@7...h.!........Z...3...7y...q.n

C:\Program Files\PCHealthCheck\fr-CA\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\fr\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13034
Entropy (8bit):	7.443623446031742
Encrypted:	false
SSDEEP:	192:rC11WVwPZFoPFW86W7LoIoaRMuWQ7I5JYWqTGQ7t1wqqLAdEwehEWdGYY:MZuWIo7s75Bp1BqLACbhbdGV
MD5:	183A1EE7B2AA8DAE8CBF8469AE75C76D
SHA1:	3A0D56609ECD072729D36D73E8EEBE1E35A0FBBD
SHA-256:	0212DADCE7C8A4FD92F3B4A79B3455C42CC2EDA01EEC143538AAB5E8C3219C6F
SHA-512:	7A692E6AF1C5E513D39B3C6B9F49A3416F940723015ADB362BFFAD24ED32DCF5BAD9A59BE293897769410F9A0378E8C52DD504BF88BFCE374E77F938ADEE973B
Malicious:	false
Preview:	6....(.2......\dh,.I...Ap.&"J.wO..o.T+...q..Xl..u.]..x.i.jNH=.........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L......x.(.2......^E.-.R....x.&"J.wO..o.D+...q..X\|..u.]..x.i.j.H=..........0......lZ....@.......................................... ...................'..........................................{...(.2....t.\d.,.I....p.&"J.wO..o.T+...q..Xl..f)..xfi.j.X=.....................@..@.rsrc........ ......................@..@......Pb........T........................rdata......T....rdata$z...x.(.2......\d.^.;....p.&.j.w...o.&X...A..Xl..u.]..x.i.j.H=.................................................................................................................................{...(.2....t.\d.,.I....p.&"J.wO..o.T+...q..Xl..u.]..x.i.j.H=.................................................................................................................................{...(.2....t.\d.,.I....p.&"J.wO..o.T+.

C:\Program Files\PCHealthCheck\fr\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\gl-ES\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13570
Entropy (8bit):	7.425183569066308
Encrypted:	false
SSDEEP:	384:V2WW3OmDH8rO0sN7Ntr+Tp85e5ej0t0XYIhFtH:oOmTPZNF+V85s75IhF1
MD5:	0BD7368B14A870D17632BB7369B86B7A
SHA1:	E825DFC0ABCC5C5F85E8336A6BF586D47C10C370
SHA-256:	7191AA19C13BC3C7FC191D7C579A069B1749A11BBC542983766CDED56185DE60
SHA-512:	EBB23B707419299100CD1B02183552DD58D8451C876E32BED685FD819345D3689A33C862331D8761DB9F26039E46989FB26E53CD4E688E4A44C3C743E48B7C19
Malicious:	false
Preview:	04..._..:j.....1..x............+..F)..]B.J.5.H.$.1 9.....w\..........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L........_..:j..b.+...c............+..V)..MB.J.5.H.$.1"9......\...........0......F.....@.......................................... ..@................'..........................................}n^..._..:j..b.....x............+..F)..]B.J.5.f.@.EA9......L......................@..@.rsrc...@.... ......................@..@......Pb........T........................rdata......T....rdata$z..:.._...j..b...g...-,:....p....+..4Zb.yr7J.5.H.$.1 9......\..................................................................................................................................}n^..._..:j..b.....x............+..F)..]B.J.5.H.$.1 9......\..................................................................................................................................}n^..._..:j..b.....x............+..F).

C:\Program Files\PCHealthCheck\gl-ES\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\he\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13034
Entropy (8bit):	7.475494045366825
Encrypted:	false
SSDEEP:	384:T8QWqOnZYiIoU+Xr3aXYLS5KoQZpaP0ZZ:gAOZuobr1L8KoUpaPKZ
MD5:	50B60B853D50C134DC83DF73E60C7E71
SHA1:	1BE87A7ECD6A320783324B0B55AFD7499485FB4D
SHA-256:	EDC77346AA905245E79AE2C0DFD632E1F05C9544C432AAB159AA076A7A22FC61
SHA-512:	C8CFCDF0C9C615E8D2C6908B6C0B2A99614855B0E26C650045DCF377BC7F4E882ACBE281DF9FDA2314BD2F8100F5CBD57947B5D12A5D4184AF0B46AED0792E99
Malicious:	false
Preview:	..O.q..]pW.4....d.%...ubO....U0P.;<..s]i.N.h....`....xx.........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L....i..r..]tW.4.}. a....%..ubO....U0P.;<..s]i:.^.h....f....xx..........0............@.......................................... ..d................'............................................r..]tW.4.}..j..d.%..ubO....U0P.;<..s]i.<..l.......hx.....................@..@.rsrc...d.... ......................@..@......Pb........T........................rdata......T....rdata$z.......]tw.4.}..D...I0...ub......U0~.HN...s]i.N.h....`....xx...................................................................................................................................r..]tW.4.}..j..d.%..ubO....U0P.;<..s]i.N.h....`....xx...................................................................................................................................r..]tW.4.}..j..d*.%..ubO....U0P.;<

C:\Program Files\PCHealthCheck\he\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\hr\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13034
Entropy (8bit):	7.449357988966109
Encrypted:	false
SSDEEP:	384:EYYjmWlZC9kGIoA0DuNjb1oUCS0+n3qpJD:ss9k1oxiNotS0+3WD
MD5:	621422C7E781481B63D5748ADF8948E7
SHA1:	ABFB5DC6CC5024B9D7A0D9B9EEC9B49C504BF278
SHA-256:	5DE7D29E6FEF0540A7600C41EE284436D76C5DBD928C9149BD577C5982EC2174
SHA-512:	FF9C08397DE909E6121FA5A7D1FBC95573773E0DBF8EC9C8A00066AF2B6B844AC2E4976453299DD7815F5258324F8859F6DEE1B2D8DDFA8AE3B6514DC198C9A7
Malicious:	false
Preview:	v.CP.C..Z.f.]......4..<....J.5...\G.sl].............T3.....OL.........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L....k.2.C..^.f.Bv...../..\|....J.5...\G.sl].............T3.....OL..........0......&.....@.......................................... ...................'..........................................;..P.C..^.f.v.....4..\|....J.5...\G.sl]........`...yT3....._L.....................@..@.rsrc........ ......................@..@......Pb........T........................rdata......T....rdata$zA..2.C..^.f.Rv...k.F....\|...Zj.5I..\i...>%...........T3.....OL.................................................................................................................................;..P.C..^.f.v.....4..\|....J.5...\G.sl].............T3.....OL.................................................................................................................................;..P.C..^.f.v.....4..\|....J.5...\G.sl

C:\Program Files\PCHealthCheck\hr\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\hu\PCHealthCheck.exe.mui

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	data
Category:	dropped
Size (bytes):	13034
Entropy (8bit):	7.452670027970371
Encrypted:	false
SSDEEP:	384:EzHWzoZdTpvIovGyyiWXQYBLKpps+Jb8SFT:EJLVAovhylpBqps+B8SFT
MD5:	7936244939597C650D1D9000887E1BC9
SHA1:	E051D44D4A5DD877F19BB4C70B6CAF1DBE9B6BED
SHA-256:	FAFACF46910F1A4C9DB16ADAF1FA01310122A25B6A12C265C3116C918E6CD334
SHA-512:	991F68E90A4271BE077EB747DB22CD7211750EC391324B12B43042EA1BFDCA77DBD7C04534785590A750CA2ACC31C4F58BFB68B660F9B9F19325D089461059CC
Malicious:	false
Preview:	.B...x..^:"3......#a.Vo..........[.\|8B..P.......82..>./\|....<.........!..L.!This program cannot be run in DOS mode....$.......E.<...R...R...R.......R...P...R.Rich..R.................PE..L.....F\|.x..Z:"3....k..8a.Vo..........[.\|(B..@.......(2..<./z...\.<..........0............@.......................................... ...................'..........................................^....x..Z:"3@...`..#a.Vo..........[.\|8B..P.......JV.._./....\.<.....................@..@.rsrc........ ......................@..@......Pb........T........................rdata......T....rdata$z$br\|.x..Z."3....N..Q..f^..........[.RJ1..t.......82..>./\|...\.<.................................................................................................................................^....x..Z:"3@...`..#a.Vo..........[.\|8B..P.......82..>./\|...\.<.................................................................................................................................^....x..Z:"3@...`..#a.Vo..........[.\|8B.

C:\Program Files\PCHealthCheck\hu\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\id\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\is-IS\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\it\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\PCHealthCheck\ja\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	false
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Program Files\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\ProgramData\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\Users\user\AppData\Local\Temp\fkdjsadasd.ico

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel
Category:	dropped
Size (bytes):	16958
Entropy (8bit):	2.9616661784314777
Encrypted:	false
SSDEEP:	384:WGHssrGGGGGsGGGGGGGGrcGGJsGGGGGGGGGGGGGGsGrsGsGsGGGGGsGGsGGGGrGF:WGHssrGGGGGsGGGGGGGGrcGGJsGGGGG1
MD5:	A1FAD2EA0C8FCBD0875248172BB457E8
SHA1:	648F40B1CC77AB6B34013F696F1C07D7ADF303CF
SHA-256:	2E6C63AB7769F3F7EA2F3622A865D857ECB14D7F2DDBD4AB64E15B6C3DC5E14A
SHA-512:	034DC081B23FC5A42D23AA3CB76A50A329BAD1BC79CCF37A33C9C78CC642D941AE22649879AC43F87077000711CEF0FBECE27C80313F83C53195084CFE6528F2
Malicious:	false
Preview:	......@@.... .(B......(...@......... ......@....................0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...2...0...0...2...0...2...0...0...0...0...0...0...2...0...0...0...0...2...0...2...0...0...0...0...0...0...0...0...2...0...0...0...2...0...0...2...2...0...0...0...2...0...0...0...0...2...0...0...0...2...0...0...0...2...0...0...0...2...0...0...2...0...0...2...0...2...2...0...0...0...0...2...0...2...0...0...0...0...0...0...0...0...0...0...2...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...2...0...0...0...0...2...0...0...0...0...2...0...2...0...0...0...0...0...0...0...2...0...0...0...0...2...0...0...0...0...0...0...0...0...0...0...0.......0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0...0.......0...0...0...0...0...0...0...0...0...0.......

C:\Users\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

C:\instructions_read_me.txt

Download File

Process:	C:\Users\user\Desktop\HkObDPju6Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.804750185554599
Encrypted:	false
SSDEEP:	24:F6SGOzWKJa3XWOCYj1C1PpiyE/xVHpmjxNkX0lOhA5:VGOzW6CwRNsxV0jVOK5
MD5:	BA21D49977850F54961EDE73B7E9E480
SHA1:	BD630B3DBE9D7139527C1FFDBB2161E7A9067AE0
SHA-256:	34757273C5E041F07B0352C51CFAB2998AB676F3A39BC0F16A1B4D68F3FAC4F8
SHA-512:	4BF9BE5F41F7258357E838BA94F0AA2B7F17D8FE3266174AAF123156B422C4FB72E4D3FD36DB7B2E3E9D13202202D2A6B0ECCA06EE2A2A043CE6AD27FFD751E2
Malicious:	true
Preview:	ATTENTION!..Your network has been breached and all data was encrypted. Please contact us at:..https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ ......Login ID: 26d371a9-efda-4e82-9989-01e292244d65......! To access .onion websites download and install Tor Browser at:.... https://www.torproject.org/ (Tor Browser is not related to us)....! To restore all your PCs and get your network working again, follow these instructions:....- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.....Please follow these simple rules to avoid data corruption:....- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. ....- Do not hire a recovery company. They can't decrypt without the key. ..They also don't care about your business. They believe that they are ..good negotiator

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.044268283359809
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	HkObDPju6Z.exe
File size:	1489920
MD5:	6441d7260944bcedc5958c5c8a05d16d
SHA1:	46257982840493eca90e051ff1749e7040895584
SHA256:	723d1cf3d74fb3ce95a77ed9dff257a78c8af8e67a82963230dd073781074224
SHA512:	af88fd3a0a2728c811be524feee575d8d2d9623b7944021c83173e40dbec6b1fbe7bea64dcdd8f1dbebc7d8df76b40e5c9647e2586316ea46ceb191ebcf14d89
SSDEEP:	24576:1p2gwjk6ikYhJ9lvGnYZvy48/V33ck7LnBAyldFu8hod/Qodly:1AgxkmvGnYWccjBAwFadRd
TLSH:	9B65D000B680C036FA722870556AABB2897EBC30976555CF23C43D7B6E726D19D3672F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......W.....................L.......7............@..........................P............@................................

File Icon


Icon Hash:	3fc7a3c665f3c37d

Static PE Info

General

Entrypoint:	0x4237d9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5717C407 [Wed Apr 20 18:01:43 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	e7481059b799ac586859298d4788584d

Entrypoint Preview

Instruction
call 00007F8B78D9ABFDh
jmp 00007F8B78D9A358h
retn 0000h
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov eax, dword ptr [eax]
pop ebp
ret
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov eax, dword ptr [eax]
pop ebp
ret
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov edx, 0048E840h
mov ecx, 0048E840h
sub eax, edx
sub ecx, edx
cmp eax, ecx
jnbe 00007F8B78D9A533h
int3
pop ebp
ret
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov edx, 0048E840h
mov ecx, 0048E840h
sub eax, edx
sub ecx, edx
cmp eax, ecx
jnbe 00007F8B78D9A537h
push 00000041h
pop ecx
int 29h
pop ebp
ret
retn 0000h
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov edx, 0048E840h
mov ecx, 0048E840h
sub eax, edx
sub ecx, edx
cmp eax, ecx
jnbe 00007F8B78D9A543h
cmp dword ptr [0047E620h], 00000000h
je 00007F8B78D9A53Ah
mov eax, dword ptr [0047E620h]
pop ebp
jmp eax
pop ebp
ret
push ebp
mov ebp, esp
cmp dword ptr [0047E620h], 00000000h
je 00007F8B78D9A53Ah
mov eax, dword ptr [0047E620h]
pop ebp
jmp eax
pop ebp
ret
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov edx, 0048E840h
mov ecx, 0048E840h
sub eax, edx
sub ecx, edx
cmp ecx, eax
sbb eax, eax
inc eax
pop ebp
ret
push ebp
mov ebp, esp
mov ecx, dword ptr [ebp+08h]
mov eax, ecx
sub eax, dword ptr [ebp+0Ch]
sub eax, 0000E800h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x90c70	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11e000	0x50378	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x16f000	0x5110	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8e780	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x8e880	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x85578	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x90b68	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x7c9ea	0x7ca00	False	0.41879348984453363	data	6.631020869912357	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7e000	0x14e72	0x15000	False	0.5792178199404762	data	6.1426369171952455	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x93000	0x8a5b0	0x84800	False	0.9093639445754716	data	7.357984406581138	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x11e000	0x50378	0x50400	False	0.501323379088785	data	5.824284929352815	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x16f000	0x5110	0x5200	False	0.784108231707317	data	6.756606998856607	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x147588	0x134	Targa image data 64 x 65536 x 1 +32 "\001"	English	United States
RT_BITMAP	0x1476d8	0x3c28	Device independent bitmap graphic, 240 x 16 x 32, image size 15360, resolution 3779 x 3779 px/m	English	United States
RT_BITMAP	0x14b300	0x428	Device independent bitmap graphic, 16 x 16 x 32, image size 1024, resolution 3779 x 3779 px/m	English	United States
RT_ICON	0x11ec00	0x1011a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x12ed20	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States
RT_ICON	0x13f548	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States
RT_ICON	0x143770	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States
RT_ICON	0x145d18	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States
RT_ICON	0x146dc0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States
RT_ICON	0x147288	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512, 16 important colors	English	United States
RT_ICON	0x14baf8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0	English	United States
RT_ICON	0x15c320	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	English	United States
RT_ICON	0x160548	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States
RT_ICON	0x162af0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States
RT_ICON	0x163b98	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States
RT_ICON	0x164050	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States
RT_ICON	0x165110	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States
RT_ICON	0x1661d0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States
RT_ICON	0x167290	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States
RT_ICON	0x168350	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512, 16 important colors	English	United States
RT_ICON	0x168650	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States
RT_ICON	0x169710	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512, 16 important colors	English	United States
RT_MENU	0x169a10	0x53e	data	English	United States
RT_DIALOG	0x169f50	0x1a8	data	English	United States
RT_DIALOG	0x16a0f8	0x1b0	data	English	United States
RT_DIALOG	0x16a480	0x1dc	data	English	United States
RT_DIALOG	0x16a660	0x1dc	data	English	United States
RT_DIALOG	0x16a840	0x130	data	English	United States
RT_DIALOG	0x16aaa0	0x210	data	English	United States
RT_DIALOG	0x16a2a8	0x1d4	data	English	United States
RT_DIALOG	0x16a970	0x130	data	English	United States
RT_DIALOG	0x16bbe0	0x560	data	English	United States
RT_DIALOG	0x16c140	0x244	data	English	United States
RT_DIALOG	0x16acb0	0x4a2	data	English	United States
RT_DIALOG	0x16b158	0x4ae	data	English	United States
RT_DIALOG	0x16b608	0x3ba	data	English	United States
RT_DIALOG	0x16b9c8	0x218	data	English	United States
RT_STRING	0x16c928	0xa6	data	English	United States
RT_STRING	0x16d510	0x1e0	Matlab v4 mat-file (little endian) i, numeric, rows 0, columns 0	English	United States
RT_STRING	0x16d738	0x1b0	data	English	United States
RT_STRING	0x16c800	0x124	data	English	United States
RT_STRING	0x16c9d0	0xb3e	data	English	United States
RT_STRING	0x16c388	0x478	data	English	United States
RT_STRING	0x16d6f0	0x48	data	English	United States
RT_ACCELERATOR	0x14b728	0x1a0	data	English	United States
RT_GROUP_CURSOR	0x1476c0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_ICON	0x147228	0x5a	Targa image data - Map 32 x 282 x 1 +1	English	United States
RT_GROUP_ICON	0x1650f8	0x14	data	English	United States
RT_GROUP_ICON	0x168638	0x14	data	English	United States
RT_GROUP_ICON	0x167278	0x14	data	English	United States
RT_GROUP_ICON	0x168338	0x14	data	English	United States
RT_GROUP_ICON	0x1696f8	0x14	data	English	United States
RT_GROUP_ICON	0x1661b8	0x14	data	English	United States
RT_GROUP_ICON	0x1699f8	0x14	data	English	United States
RT_GROUP_ICON	0x147570	0x14	data	English	United States
RT_GROUP_ICON	0x164000	0x4c	data	English	United States
RT_VERSION	0x14b8c8	0x22c	data	English	United States
RT_MANIFEST	0x16d8e8	0xa90	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2644), with CRLF line terminators	English	United States

Imports

DLL	Import
SHLWAPI.dll	PathGetDriveNumberW, StrCmpNIW, StrDupW, StrChrA, PathRelativePathToW, PathIsPrefixW, PathFindFileNameW, PathUnExpandEnvStringsW, PathIsRootW, PathCanonicalizeW, PathFindExtensionW, PathCommonPrefixW, PathCompactPathExW, PathRemoveExtensionW, StrFormatByteSizeW, PathStripPathW, PathRemoveBackslashW, StrRetToBufW, PathMatchSpecW, StrCatBuffW, PathUnquoteSpacesW, StrChrW, StrTrimW, SHAutoComplete, StrCpyNW, PathQuoteSpacesW, PathRenameExtensionW, PathIsDirectoryW, StrRChrW, PathAppendW, PathIsRelativeW, PathFileExistsW, PathAddBackslashW, PathRemoveFileSpecW, PathIsSameRootW
PSAPI.DLL	EnumProcessModules, GetModuleFileNameExW
USER32.dll	OffsetRect, OpenClipboard, BeginDeferWindowPos, GetSubMenu, TrackPopupMenu, LoadAcceleratorsW, DeleteMenu, ShowOwnedPopups, CopyImage, MessageBoxW, EqualRect, IsWindowVisible, ShowWindowAsync, GetMessagePos, LoadMenuW, CharUpperW, GetKeyState, DefWindowProcW, GetMenuItemInfoW, DeferWindowPos, GetMessageW, CloseClipboard, SetMenuItemInfoW, EmptyClipboard, RegisterClassW, SetWindowPlacement, FrameRect, SetMenuDefaultItem, EnumWindows, GetMessageTime, IntersectRect, SetFocus, BringWindowToTop, TranslateAcceleratorW, GetWindowDC, EndDeferWindowPos, SetClipboardData, CheckMenuItem, IsZoomed, KillTimer, PostQuitMessage, GetSysColorBrush, EnableMenuItem, RegisterWindowMessageW, UpdateWindow, IsIconic, GetWindowThreadProcessId, DrawAnimatedRects, FindWindowExW, GetDC, MonitorFromRect, SetActiveWindow, LoadStringA, SetWindowTextW, LoadStringW, DdeCreateStringHandleW, DdeConnect, GetMonitorInfoW, DdeInitializeW, SetTimer, SetWindowCompositionAttribute, SystemParametersInfoW, SetPropW, RedrawWindow, SendMessageW, wsprintfW, GetSysColor, CharPrevW, GetWindowPlacement, GetSystemMetrics, DdeUninitialize, DialogBoxIndirectParamW, DdeClientTransaction, SetLayeredWindowAttributes, CharUpperBuffW, SetRect, DdeDisconnect, SetForegroundWindow, LoadImageW, ReleaseDC, GetPropW, RemovePropW, DispatchMessageW, PeekMessageW, TranslateMessage, GetWindowLongW, GetWindowTextLengthW, GetSystemMenu, AdjustWindowRectEx, PostMessageW, CheckMenuRadioItem, GetWindowRect, GetFocus, DestroyWindow, SetWindowPos, CheckRadioButton, MessageBoxExW, CreateWindowExW, EndDialog, MessageBeep, CreatePopupMenu, WindowFromPoint, DestroyCursor, ShowWindow, DestroyIcon, GetDlgCtrlID, SetDlgItemTextW, MapWindowPoints, GetDlgItemTextW, SendDlgItemMessageW, IsWindowEnabled, IsDlgButtonChecked, DestroyMenu, GetMenuStringW, CharNextW, LoadIconW, LoadCursorW, GetClassNameW, SetCapture, InsertMenuW, SetCursor, SetWindowLongW, TrackPopupMenuEx, GetComboBoxInfo, GetClientRect, GetDlgItem, AppendMenuW, CheckDlgButton, GetParent, ReleaseCapture, InvalidateRect, ChildWindowFromPoint, GetCursorPos, EnableWindow, GetWindowTextW, DdeFreeStringHandle
KERNEL32.dll	RaiseException, GetSystemInfo, VirtualQuery, GetModuleHandleW, LoadLibraryExA, EnterCriticalSection, LeaveCriticalSection, DecodePointer, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, WaitForSingleObjectEx, ReadConsoleW, GetConsoleMode, VirtualProtect, CompareStringOrdinal, FreeLibrary, LoadLibraryExW, ReadFile, lstrlenW, WriteFile, lstrcpynW, ExpandEnvironmentStringsW, GetModuleFileNameW, SetFilePointer, SetEndOfFile, UnlockFileEx, CreateFileW, GetSystemDirectoryW, MultiByteToWideChar, lstrcatW, CloseHandle, LockFileEx, GetFileSize, WideCharToMultiByte, lstrcpyW, lstrcmpiW, lstrcmpW, FlushFileBuffers, GetShortPathNameW, LocalAlloc, GetFileAttributesW, SetFileAttributesW, FormatMessageW, GetLastError, GetCurrentDirectoryW, LocalFree, WaitForSingleObject, CreateEventW, SetEvent, GlobalAlloc, GlobalFree, ResetEvent, SizeofResource, SearchPathW, GetLocaleInfoEx, FreeResource, OpenProcess, LockResource, LoadLibraryW, LoadResource, FindResourceW, GetWindowsDirectoryW, GetProcAddress, GlobalLock, GlobalUnlock, MulDiv, CreateDirectoryW, FindFirstFileW, GetCommandLineW, SetErrorMode, FindClose, GetUserPreferredUILanguages, FindFirstChangeNotificationW, GetVersion, ResolveLocaleName, GlobalSize, FileTimeToSystemTime, FindCloseChangeNotification, LoadLibraryA, FileTimeToLocalFileTime, FindNextChangeNotification, SetCurrentDirectoryW, GetTimeFormatW, ExitProcess, VerSetConditionMask, CopyFileW, VerifyVersionInfoW, GetDateFormatW, MapViewOfFile, CreateFileMappingW, LocaleNameToLCID, FindResourceExW, LCIDToLocaleName, UnmapViewOfFile, GetVersionExW, GetLocaleInfoW, GetUserDefaultUILanguage, GetSystemDefaultUILanguage, SetLastError, UnhandledExceptionFilter, GetConsoleOutputCP, HeapReAlloc, HeapSize, SetFilePointerEx, GetFileSizeEx, GetStringTypeW, SetStdHandle, OutputDebugStringW, SetConsoleCtrlHandler, GetProcessHeap, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, LCMapStringW, CompareStringW, GetFileType, HeapAlloc, HeapFree, GetCurrentThread, GetStdHandle, GetModuleHandleExW, FreeLibraryAndExitThread, ResumeThread, ExitThread, CreateThread, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, EncodePointer, InterlockedFlushSList, InterlockedPushEntrySList, RtlUnwind, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, GetStartupInfoW, IsDebuggerPresent, IsProcessorFeaturePresent, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, WriteConsoleW
GDI32.dll	GetStockObject, SetBkColor, ExtTextOutW, EnumFontsW, GetDeviceCaps, SetTextColor, GetObjectW, DeleteObject, CreateSolidBrush, CreateFontIndirectW
COMDLG32.dll	GetSaveFileNameW, ChooseColorW, GetOpenFileNameW
ADVAPI32.dll	RegOpenKeyExW, RegQueryValueExW, RegCloseKey
SHELL32.dll	SHGetFolderPathW, SHGetSpecialFolderPathW, ShellExecuteW, SHCreateDirectoryExW, SHFileOperationW, SHBrowseForFolderW, SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHGetFileInfoW, SHGetDesktopFolder, SHAppBarMessage, DragQueryFileW, Shell_NotifyIconW, DragAcceptFiles, DragFinish, SHGetDataFromIDListW
ole32.dll	OleUninitialize, CoCreateInstance, OleInitialize, CoUninitialize, CoTaskMemAlloc, CoTaskMemFree, CoInitialize, DoDragDrop
ntdll.dll	RtlGetNtVersionNumbers
COMCTL32.dll	ImageList_AddMasked, InitCommonControlsEx, ImageList_Create, ImageList_Destroy, PropertySheetW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	3
Start time:	21:33:29
Start date:	12/06/2023
Path:	C:\Users\user\Desktop\HkObDPju6Z.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\HkObDPju6Z.exe
Imagebase:	0x7d0000
File size:	1489920 bytes
MD5 hash:	6441D7260944BCEDC5958C5C8A05D16D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlackBasta, Description: Yara detected BlackBasta ransomware, Source: 00000003.00000003.22575159083.0000000002F20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: cmd.exePID: 312, Parent PID: 332

General

Target ID:	5
Start time:	21:33:33
Start date:	12/06/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Imagebase:	0x3d0000
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	6
Start time:	21:33:33
Start date:	12/06/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6a93c0000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	7
Start time:	21:33:34
Start date:	12/06/2023
Path:	C:\Windows\System32\vssadmin.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Imagebase:	0x7ff7fcb60000
File size:	145920 bytes
MD5 hash:	B58073DB8892B67A672906C9358020EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	10
Start time:	21:33:47
Start date:	12/06/2023
Path:	C:\Users\user\Desktop\HkObDPju6Z.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HkObDPju6Z.exe"
Imagebase:	0x7d0000
File size:	1489920 bytes
MD5 hash:	6441D7260944BCEDC5958C5C8A05D16D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlackBasta, Description: Yara detected BlackBasta ransomware, Source: 0000000A.00000003.22756871962.00000000028F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlackBasta, Description: Yara detected BlackBasta ransomware, Source: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	11
Start time:	21:33:52
Start date:	12/06/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Imagebase:	0x3d0000
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	12
Start time:	21:33:52
Start date:	12/06/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6a93c0000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	13
Start time:	21:33:52
Start date:	12/06/2023
Path:	C:\Windows\System32\vssadmin.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Imagebase:	0x7ff7fcb60000
File size:	145920 bytes
MD5 hash:	B58073DB8892B67A672906C9358020EC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	14
Start time:	21:33:55
Start date:	12/06/2023
Path:	C:\Users\user\Desktop\HkObDPju6Z.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HkObDPju6Z.exe"
Imagebase:	0x7d0000
File size:	1489920 bytes
MD5 hash:	6441D7260944BCEDC5958C5C8A05D16D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlackBasta, Description: Yara detected BlackBasta ransomware, Source: 0000000E.00000003.22839485707.0000000002980000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlackBasta, Description: Yara detected BlackBasta ransomware, Source: 0000000E.00000002.22856927512.0000000002A90000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Target ID:	15
Start time:	21:34:00
Start date:	12/06/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Imagebase:	0x3d0000
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	16
Start time:	21:34:00
Start date:	12/06/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6a93c0000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	17
Start time:	21:34:00
Start date:	12/06/2023
Path:	C:\Windows\System32\vssadmin.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet
Imagebase:	0x7ff7fcb60000
File size:	145920 bytes
MD5 hash:	B58073DB8892B67A672906C9358020EC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	28
Start time:	21:36:08
Start date:	12/06/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c start /MAX notepad.exe c:\instructions_read_me.txt
Imagebase:	0x3d0000
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	29
Start time:	21:36:09
Start date:	12/06/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6a93c0000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	30
Start time:	21:36:09
Start date:	12/06/2023
Path:	C:\Windows\SysWOW64\notepad.exe
Wow64 process (32bit):	true
Commandline:	notepad.exe c:\instructions_read_me.txt
Imagebase:	0x120000
File size:	165888 bytes
MD5 hash:	E92D3A824A0578A50D2DD81B5060145F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlackBasta, Description: Yara detected BlackBasta ransomware, Source: 0000001E.00000002.27586886931.0000000003343000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	16.6%
Signature Coverage:	26.3%
Total number of Nodes:	706
Total number of Limit Nodes:	43

Executed Functions

Function 02A435D0 Relevance: 260.4, Strings: 205, Instructions: 4161COMMON

Download Yara Rule

Strings

m, xrefs: 02A46D27
U, xrefs: 02A476A0
n, xrefs: 02A44DFA
Q, xrefs: 02A445F8
P, xrefs: 02A452FD
T, xrefs: 02A45CD1
>, xrefs: 02A442FF
s, xrefs: 02A451C3
%, xrefs: 02A44BE5
2, xrefs: 02A470CD
z, xrefs: 02A44175
$, xrefs: 02A45CF9
|, xrefs: 02A441B1
<, xrefs: 02A44EC3
O, xrefs: 02A4686D
3, xrefs: 02A44C03
}, xrefs: 02A469CE
z, xrefs: 02A4417F
r, xrefs: 02A45A0E
5, xrefs: 02A43B9C
>, xrefs: 02A45309
A, xrefs: 02A45E40
y, xrefs: 02A4396B
$, xrefs: 02A45DA8
x, xrefs: 02A43F6C
{, xrefs: 02A451AF
f, xrefs: 02A45411
{, xrefs: 02A43DF2
W, xrefs: 02A43C53
w, xrefs: 02A451A5
$, xrefs: 02A44BEF
V, xrefs: 02A43C7B
r, xrefs: 02A43623
>, xrefs: 02A44F93
6, xrefs: 02A43CFD
5, xrefs: 02A436EE
;, xrefs: 02A44331
., xrefs: 02A447DC
V, xrefs: 02A44BCF
V, xrefs: 02A43A1C
h, xrefs: 02A453CB
q, xrefs: 02A4379F
-, xrefs: 02A4562E
}, xrefs: 02A453FD
S, xrefs: 02A4494C
3, xrefs: 02A43C3D
", xrefs: 02A4617A
U, xrefs: 02A4778F
p, xrefs: 02A451CD
3, xrefs: 02A4751C
U, xrefs: 02A464CF
y, xrefs: 02A451D7
#, xrefs: 02A45327
3, xrefs: 02A45D94
V, xrefs: 02A475DC
i, xrefs: 02A4364B
n, xrefs: 02A43619
Y, xrefs: 02A43ADC
L, xrefs: 02A4599D
u, xrefs: 02A43DDE
f, xrefs: 02A453E9
|, xrefs: 02A4394D
G, xrefs: 02A4451C
W, xrefs: 02A460CE
M, xrefs: 02A46196
e, xrefs: 02A44693
>, xrefs: 02A4387C
_, xrefs: 02A4549C
~, xrefs: 02A44193
F, xrefs: 02A46746
1, xrefs: 02A45CDB
y, xrefs: 02A43DD4
v, xrefs: 02A43993
', xrefs: 02A4370C
H, xrefs: 02A46754
n, xrefs: 02A43E8F
2, xrefs: 02A44BDB
', xrefs: 02A43702
L, xrefs: 02A46BEC
c, xrefs: 02A43989
K, xrefs: 02A450EC
A, xrefs: 02A44B29
m, xrefs: 02A451B9
1, xrefs: 02A44327
w, xrefs: 02A448A4
Z, xrefs: 02A44731
<, xrefs: 02A4433B
g, xrefs: 02A453DF
`, xrefs: 02A46B4C
i, xrefs: 02A46D47
&, xrefs: 02A4431D
a, xrefs: 02A46D33
g, xrefs: 02A4362D
", xrefs: 02A45331
D, xrefs: 02A44602
[, xrefs: 02A4674D
W, xrefs: 02A43D3B
", xrefs: 02A457AC
y, xrefs: 02A4556C
L, xrefs: 02A443BC
<, xrefs: 02A4531D
b, xrefs: 02A43DE8
M, xrefs: 02A46181
_, xrefs: 02A43D27
7, xrefs: 02A47399
9, xrefs: 02A44C0D
{, xrefs: 02A4620C
b, xrefs: 02A453F3
, xrefs: 02A45CE5
g, xrefs: 02A448AE
v, xrefs: 02A469EC
o, xrefs: 02A4360F
7, xrefs: 02A45DB2
9, xrefs: 02A4533B
S, xrefs: 02A47864
b, xrefs: 02A43DFC
}, xrefs: 02A4419D
E, xrefs: 02A46912
}, xrefs: 02A43975
Z, xrefs: 02A43C71
}, xrefs: 02A456EC
<, xrefs: 02A4503C
1, xrefs: 02A45DBC
@, xrefs: 02A445EE
U, xrefs: 02A4460C
`, xrefs: 02A43943
m, xrefs: 02A45EB9
V, xrefs: 02A46A73
b, xrefs: 02A44C9C
`, xrefs: 02A469E2
&, xrefs: 02A45CEF
p, xrefs: 02A4397F
p, xrefs: 02A43961
Q, xrefs: 02A4601D
p, xrefs: 02A43934
4, xrefs: 02A436F8
0, xrefs: 02A47010
K, xrefs: 02A46412
c, xrefs: 02A4401D
@, xrefs: 02A4618F
^, xrefs: 02A43C49
U, xrefs: 02A445E4
b, xrefs: 02A46D3D
G, xrefs: 02A4619D
:, xrefs: 02A47720
q, xrefs: 02A4489A
z, xrefs: 02A441A7
], xrefs: 02A4675B
d, xrefs: 02A453D5
S, xrefs: 02A43D1D
U, xrefs: 02A462B1
|, xrefs: 02A46F4C
A, xrefs: 02A43C67
D, xrefs: 02A43D07
G, xrefs: 02A45D8A
:, xrefs: 02A442F5
~, xrefs: 02A46D5B
F, xrefs: 02A436E4
i, xrefs: 02A47CAF
`, xrefs: 02A469D8
l, xrefs: 02A451E1
v, xrefs: 02A43641
,, xrefs: 02A47977
,, xrefs: 02A478EB
p, xrefs: 02A4365F
i, xrefs: 02A47B98
$, xrefs: 02A45313
|, xrefs: 02A44189
k, xrefs: 02A47A7E
L, xrefs: 02A4718C
z, xrefs: 02A46D51
%, xrefs: 02A445D8
;, xrefs: 02A4725C
y, xrefs: 02A448B8
E, xrefs: 02A43D13
>, xrefs: 02A46738
&, xrefs: 02A45D9E
f, xrefs: 02A43E06
u, xrefs: 02A47638
:, xrefs: 02A44309
r, xrefs: 02A43637
W, xrefs: 02A44616
}, xrefs: 02A45407
G, xrefs: 02A46188
5, xrefs: 02A45345
Z, xrefs: 02A43D45
#, xrefs: 02A43716
R, xrefs: 02A442E9
p, xrefs: 02A448C2
6, xrefs: 02A44313
l, xrefs: 02A43957
C, xrefs: 02A47B1D
4, xrefs: 02A4448F
E, xrefs: 02A43D31
Q, xrefs: 02A440BC
@, xrefs: 02A43C5D
\, xrefs: 02A4673F
a, xrefs: 02A47460
b, xrefs: 02A46DD8
&, xrefs: 02A47A0F
", xrefs: 02A44C17
", xrefs: 02A45D03
?, xrefs: 02A44BF9
e, xrefs: 02A469C4
~, xrefs: 02A44D3C

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID:
String ID: $"$"$"$"$"$#$#$$$$$$$$$%$%$&$&$&$&$'$'$,$,$-$.$0$1$1$1$2$2$3$3$3$3$4$4$5$5$5$6$6$7$7$9$9$:$:$:$;$;$<$<$<$<$>$>$>$>$>$?$@$@$@$A$A$A$C$D$D$E$E$E$F$F$G$G$G$G$H$K$K$L$L$L$L$M$M$O$P$Q$Q$Q$R$S$S$S$T$U$U$U$U$U$U$V$V$V$V$V$W$W$W$W$Y$Z$Z$Z$[$\$]$^$_$_$`$`$`$`$a$a$b$b$b$b$b$b$c$c$d$e$e$f$f$f$g$g$g$h$i$i$i$i$k$l$l$m$m$m$n$n$n$o$p$p$p$p$p$p$q$q$r$r$r$s$u$u$v$v$v$w$w$x$y$y$y$y$y$z$z$z$z${${${$|$|$|$|$}$}$}$}$}$}$~$~$~
API String ID: 0-2828971378
Opcode ID: eeb093f2b0b2b731cd41bdf7f694b097d793747c879a07062f86c8c548c17dcc
Instruction ID: 070a586660c23f49518887de727948fed6cc42c4a48d7fb8a235a531ee15489d
Opcode Fuzzy Hash: eeb093f2b0b2b731cd41bdf7f694b097d793747c879a07062f86c8c548c17dcc
Instruction Fuzzy Hash: CC937A789242A98ACB28DF64CC507EEB7B1AF58304F0495EEC40DEB210EB755B85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 007D4B90 Relevance: 135.3, APIs: 18, Strings: 59, Instructions: 534
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007D2810: PathFileExistsW.SHLWAPI(008E8DE8,?,?,007D4A32,634AD31B), ref: 007D2827
Part of subcall function 007D2810: PathIsDirectoryW.SHLWAPI(008E8DE8), ref: 007D283A

SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,C:\Users\user\Documents), ref: 007D4E29
GetSystemDirectoryW.KERNEL32(C:\Windows\system32\Viewers\Quikview.exe,00000104), ref: 007D4E7A
PathAddBackslashW.SHLWAPI(C:\Windows\system32\Viewers\Quikview.exe), ref: 007D4E85
lstrcatW.KERNEL32(C:\Windows\system32\Viewers\Quikview.exe,Viewers\Quikview.exe), ref: 007D4E95
lstrcpyW.KERNEL32(%USERPROFILE%\Desktop,%USERPROFILE%\Desktop), ref: 007D4EF7

Part of subcall function 007E5E90: StrCmpNIW.SHLWAPI(C:\Users\user\Documents,%CSIDL:MYDOCUMENTS%,00000013,?,00000002), ref: 007E5EB3
Part of subcall function 007E5E90: SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?,?,00000002), ref: 007E5ED3
Part of subcall function 007E5E90: PathAppendW.SHLWAPI(?,?,?,00000002), ref: 007E5EE5
Part of subcall function 007E5E90: ExpandEnvironmentStringsW.KERNEL32(?,?,00000138,?,00000002), ref: 007E5F0B
Part of subcall function 007E5E90: lstrcpynW.KERNEL32(?,?,00000104,?,00000002), ref: 007E5F2A
Part of subcall function 007E5E90: PathIsRelativeW.SHLWAPI(?,?,00000002), ref: 007E5F34
Part of subcall function 007E5E90: GetModuleFileNameW.KERNEL32(00000000,00000104,00000104,?,00000002), ref: 007E5F4A
Part of subcall function 007E5E90: PathRemoveFileSpecW.SHLWAPI(?,?,00000002), ref: 007E5F55
Part of subcall function 007E5E90: PathAppendW.SHLWAPI(?,?,?,00000002), ref: 007E5F68
Part of subcall function 007E5E90: PathCanonicalizeW.SHLWAPI(?,?,?,00000002), ref: 007E5F8C
Part of subcall function 007E5E90: lstrcpyW.KERNEL32(?,?), ref: 007E5FA3
Part of subcall function 007E5E90: PathGetDriveNumberW.SHLWAPI(?,?,00000002), ref: 007E5FAE
Part of subcall function 007E5E90: CharUpperBuffW.USER32(00000001,00000001,?,00000002), ref: 007E5FC0
Part of subcall function 007E5E90: lstrcpynW.KERNEL32(C:\Users\user\Documents,00000104,00000104,?,00000002), ref: 007E5FE6

Part of subcall function 007E5E90: lstrcpynW.KERNEL32(?,C:\Users\user\Documents,00000104,?,00000002), ref: 007E5EF4
Part of subcall function 007E5E90: lstrcpynW.KERNEL32(?,?,00000104,?,00000002), ref: 007E5F7D

Part of subcall function 007D33B0: lstrlenW.KERNEL32(?,?), ref: 007D3516

SHGetSpecialFolderPathW.SHELL32(00000000,C:\Users\user\Desktop,00000010,00000001), ref: 007D4F5F
lstrcpyW.KERNEL32(*.*,*.*), ref: 007D5012
lstrcpynW.KERNEL32(008ED39C,00000000,00000100), ref: 007D5065
GetSysColor.USER32(00000008), ref: 007D50CD
GetSysColor.USER32(0000000D), ref: 007D50F5
lstrcpyW.KERNEL32(1 2 3 4 5 0 8,1 2 3 4 5 0 8), ref: 007D5125
lstrcpyW.KERNEL32(1 2 3 4 5 0 8,1 2 3 4 5 0 8), ref: 007D5156
GetSystemMetrics.USER32(00000000), ref: 007D5252
GetSystemMetrics.USER32(00000001), ref: 007D5258
wsprintfW.USER32 ref: 007D52DD
wsprintfW.USER32 ref: 007D52ED
wsprintfW.USER32 ref: 007D52FD
wsprintfW.USER32 ref: 007D530D

Strings

ColorFilter, xrefs: 007D50FD
ClearReadOnly, xrefs: 007D4C92
%ix%i SizeX, xrefs: 007D52F1
TrackSelect, xrefs: 007D4C1A
Favorites, xrefs: 007D4DB8, 007D4DF5
MinimizeToTray, xrefs: 007D4D0A
CopyMoveDlgSizeX, xrefs: 007D522D
%USERPROFILE%\Desktop, xrefs: 007D4EE7
Quikview.exe, xrefs: 007D4E5A
%ix%i SizeY, xrefs: 007D5301
DefColorFilter, xrefs: 007D50B3
C:\Windows\system32\Viewers\Quikview.exe, xrefs: 007D4E50, 007D4E75, 007D4E80, 007D4E90, 007D4EA2, 007D4EAF
C:\Users\user\Desktop, xrefs: 007D4EFE, 007D4F23, 007D4F46, 007D4F58, 007D4F6C
BitmapHot, xrefs: 007D528C
Settings2, xrefs: 007D53AC, 007D53D8
TransparentMode, xrefs: 007D4D28
FullRowSelect, xrefs: 007D4C38
OpenWithDlgSizeY, xrefs: 007D5208
NegativeFilter, xrefs: 007D5077
%ix%i PosY, xrefs: 007D52E1
NoConfirmDelete, xrefs: 007D4C74
*.*, xrefs: 007D5008
OpenWithDlgSizeX, xrefs: 007D51E3
*.*, xrefs: 007D500D, 007D5027
SortReverse, xrefs: 007D4FF6
DefColorNoFilter, xrefs: 007D5095
Toolbar Images, xrefs: 007D5270, 007D5291, 007D52B2
QuikviewParams, xrefs: 007D4ED5
Viewers\Quikview.exe, xrefs: 007D4E8B
SortOptions, xrefs: 007D4FC1
BitmapDefault, xrefs: 007D526B
OpacityLevel, xrefs: 007D53A7
ShowToolbar, xrefs: 007D5164
ColorNoFilter, xrefs: 007D50D5
FocusLostOpacity, xrefs: 007D53D3
ToolbarButtons, xrefs: 007D5136
1 2 3 4 5 0 8, xrefs: 007D511B
%ix%i PosX, xrefs: 007D52CE
StartupDirectory, xrefs: 007D4D7C
GotoDlgSizeX, xrefs: 007D51BE
RenameOnCollision, xrefs: 007D4CB0
1 2 3 4 5 0 8, xrefs: 007D512C, 007D5151
C:\Users\user\Documents, xrefs: 007D4DAE, 007D4DEB, 007D4E0E, 007D4E1C, 007D4E36
FileFilter, xrefs: 007D502C
FillMask, xrefs: 007D4F88
Settings, xrefs: 007D4D4B, 007D4D81, 007D4DBD, 007D4DFA, 007D4E5F, 007D4EDA, 007D4F0D, 007D4F32, 007D4F8D, 007D4FC6, 007D5031, 007D50DA, 007D5102, 007D513B, 007D51C3, 007D51E8, 007D520D, 007D5232
UseRecycleBin, xrefs: 007D4C56
OpenWithDir, xrefs: 007D4F08, 007D4F2D
SingleClick, xrefs: 007D4BFC
%USERPROFILE%\Desktop, xrefs: 007D4EEC
Window, xrefs: 007D531B, 007D5339, 007D5357, 007D5375
SaveSettings, xrefs: 007D4BDE
EscFunction, xrefs: 007D4D46
AlwaysOnTop, xrefs: 007D4CEC
1 2 3 4 5 0 8, xrefs: 007D5120, 007D5131, 007D514C
ShowStatusbar, xrefs: 007D5182
ShowDriveBox, xrefs: 007D51A0
BitmapDisabled, xrefs: 007D52AD
FocusEdit, xrefs: 007D4CCE

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Path$lstrcpylstrcpyn$wsprintf$FileFolderSystem$AppendColorDirectoryMetrics$BackslashBuffCanonicalizeCharDriveEnvironmentExistsExpandModuleNameNumberRelativeRemoveSpecSpecialStringsUpperlstrcatlstrlen
String ID: %USERPROFILE%\Desktop$%USERPROFILE%\Desktop$%ix%i PosX$%ix%i PosY$%ix%i SizeX$%ix%i SizeY$*.*$*.*$1 2 3 4 5 0 8$1 2 3 4 5 0 8$1 2 3 4 5 0 8$AlwaysOnTop$BitmapDefault$BitmapDisabled$BitmapHot$C:\Users\user\Desktop$C:\Users\user\Documents$C:\Windows\system32\Viewers\Quikview.exe$ClearReadOnly$ColorFilter$ColorNoFilter$CopyMoveDlgSizeX$DefColorFilter$DefColorNoFilter$EscFunction$Favorites$FileFilter$FillMask$FocusEdit$FocusLostOpacity$FullRowSelect$GotoDlgSizeX$MinimizeToTray$NegativeFilter$NoConfirmDelete$OpacityLevel$OpenWithDir$OpenWithDlgSizeX$OpenWithDlgSizeY$Quikview.exe$QuikviewParams$RenameOnCollision$SaveSettings$Settings$Settings2$ShowDriveBox$ShowStatusbar$ShowToolbar$SingleClick$SortOptions$SortReverse$StartupDirectory$Toolbar Images$ToolbarButtons$TrackSelect$TransparentMode$UseRecycleBin$Viewers\Quikview.exe$Window
API String ID: 3534769242-913697327
Opcode ID: 39a2b632fae42575eb8e6ec21b4e907abb02aac1f4751a61ef120e59943f7313
Instruction ID: 42f6e2297d46d43109a2c526ca7eebdf424bd373cbeb4c2b88c220624c531bbc
Opcode Fuzzy Hash: 39a2b632fae42575eb8e6ec21b4e907abb02aac1f4751a61ef120e59943f7313
Instruction Fuzzy Hash: 9C12C9F0A003819BE724EBA5AC8672735B1F795705F044036EE15DB3A2E7F9984E8B53

Uniqueness

Uniqueness Score: -1.00%

Function 007E8650 Relevance: 43.9, APIs: 21, Strings: 4, Instructions: 138
comregistrywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 007E8664
SetErrorMode.KERNELBASE(00008001), ref: 007E8687

Part of subcall function 007D1E10: RtlGetNtVersionNumbers.NTDLL(008E89AC,008E89A8,008E89B0), ref: 007D1E31
Part of subcall function 007D1E10: LoadLibraryExW.KERNEL32(comctl32.dll,00000000,00000800), ref: 007D1EB3
Part of subcall function 007D1E10: FreeLibrary.KERNEL32(00000000), ref: 007D1F01

GetSysColor.USER32(00000008), ref: 007E86EE
GetSysColor.USER32(00000005), ref: 007E86F7
GetSysColor.USER32(00000017), ref: 007E8700
GetSysColor.USER32(00000018), ref: 007E8709
GetSysColor.USER32(0000000E), ref: 007E8712
GetSysColor.USER32(0000000D), ref: 007E871B
GetSysColor.USER32(00000002), ref: 007E8724
GetSysColor.USER32(00000001), ref: 007E872D
GetSysColor.USER32(0000000F), ref: 007E8736
GetSysColor.USER32(0000000F), ref: 007E873F
GetSysColor.USER32(0000000F), ref: 007E8748
GetSysColor.USER32(0000000F), ref: 007E8751
GetSysColor.USER32(0000000F), ref: 007E875A
GetSysColor.USER32(0000000F), ref: 007E8763

Part of subcall function 007EF3A0: GetCommandLineW.KERNEL32(?,75AFB1B0,?,?,?,007E877D), ref: 007EF3A5
Part of subcall function 007EF3A0: StrChrW.SHLWAPI(00000000,00000009,?,?,?,007E877D), ref: 007EF3C9
Part of subcall function 007EF3A0: StrChrW.SHLWAPI(00000000,00000009,?,?,?,007E877D), ref: 007EF3DA
Part of subcall function 007EF3A0: lstrlenW.KERNEL32(00000000,?,?,?,007E877D), ref: 007EF3EC
Part of subcall function 007EF3A0: LocalAlloc.KERNEL32(00000040,00000000,?,?,?,007E877D), ref: 007EF3FE
Part of subcall function 007EF3A0: lstrlenW.KERNEL32(00000000,?,?,?,007E877D), ref: 007EF403
Part of subcall function 007EF3A0: LocalAlloc.KERNEL32(00000040,00000000,?,?,?,007E877D), ref: 007EF40F
Part of subcall function 007EF3A0: lstrcpyW.KERNEL32(00000000,00000000), ref: 007EF41B
Part of subcall function 007EF3A0: StrChrW.SHLWAPI(00000000,00000020,?,?,?,007E877D), ref: 007EF453
Part of subcall function 007EF3A0: lstrcpyW.KERNEL32(00000000,-00000002), ref: 007EF467
Part of subcall function 007EF3A0: lstrcpyW.KERNEL32(00000000,00000000), ref: 007EF495
Part of subcall function 007EF3A0: StrChrW.SHLWAPI(00000000,00000020,?,?,?,007E877D), ref: 007EF4CB

Part of subcall function 007D4450: GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,75AFB1B0), ref: 007D4476
Part of subcall function 007D4450: lstrcmpiW.KERNEL32(008E8DE8,0085D624), ref: 007D4494

Part of subcall function 007D4740: lstrcmpiW.KERNEL32(008E8DE8,0085D624,75AFB1B0), ref: 007D475F
Part of subcall function 007D4740: lstrcpyW.KERNEL32(C:\Users\user\Desktop\HkObDPju6Z.ini,0085D420), ref: 007D4779
Part of subcall function 007D4740: lstrcpyW.KERNEL32(008E8DE8,0085D420), ref: 007D4785

Part of subcall function 007D4070: StrRChrW.SHLWAPI(008E8DE8,00000000,0000005C,?,?,?,007D54A3), ref: 007D408A
Part of subcall function 007D4070: SHCreateDirectoryExW.SHELL32(00000000,008E8DE8,00000000,?,?,?,007D54A3), ref: 007D40A2
Part of subcall function 007D4070: PathFileExistsW.SHLWAPI(008E8DE8,?,?,?,007D54A3), ref: 007D40B5
Part of subcall function 007D4070: PathIsDirectoryW.SHLWAPI(008E8DE8), ref: 007D40C4
Part of subcall function 007D4070: CreateFileW.KERNEL32(008E8DE8,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,007D54A3), ref: 007D40E3
Part of subcall function 007D4070: GetFileSize.KERNEL32(00000000,?), ref: 007D40FE
Part of subcall function 007D4070: CloseHandle.KERNEL32(00000000), ref: 007D4107

Part of subcall function 007EFF10: EnumWindows.USER32(007EFE70,00000000), ref: 007EFF51
Part of subcall function 007EFF10: IsWindowEnabled.USER32(00000000), ref: 007EFF64
Part of subcall function 007EFF10: IsIconic.USER32(00000000), ref: 007EFF76
Part of subcall function 007EFF10: ShowWindowAsync.USER32(00000009,00000009), ref: 007EFF86
Part of subcall function 007EFF10: IsWindowVisible.USER32(00000000), ref: 007EFF90
Part of subcall function 007EFF10: SendMessageW.USER32(00000400,00000400,00000000,00000203), ref: 007EFFB0
Part of subcall function 007EFF10: SendMessageW.USER32(00000400,00000400,00000000,00000202), ref: 007EFFC2
Part of subcall function 007EFF10: SetForegroundWindow.USER32(00000000), ref: 007EFFC8
Part of subcall function 007EFF10: GlobalSize.KERNEL32(?), ref: 007EFFDC
Part of subcall function 007EFF10: PathIsRelativeW.SHLWAPI ref: 007EFFF7
Part of subcall function 007EFF10: GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 007F000B
Part of subcall function 007EFF10: PathAppendW.SHLWAPI(?), ref: 007F001C
Part of subcall function 007EFF10: lstrcpyW.KERNEL32(?), ref: 007F002D
Part of subcall function 007EFF10: GlobalSize.KERNEL32 ref: 007F0041
Part of subcall function 007EFF10: SendMessageW.USER32(?,0000004A,00000000,?), ref: 007F0061
Part of subcall function 007EFF10: GlobalFree.KERNEL32 ref: 007F0069

OleInitialize.OLE32(00000000), ref: 007E87A6
InitCommonControlsEx.COMCTL32(?), ref: 007E87C9
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007E87D4
CreateSolidBrush.GDI32(00000000), ref: 007E8817
CreateSolidBrush.GDI32(00000000), ref: 007E883F

Strings

1 2 3 4 5 0 8, xrefs: 007E86B6
*.*, xrefs: 007E86CE
TaskbarCreated, xrefs: 007E87CF
%USERPROFILE%\Desktop, xrefs: 007E86B0

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Color$lstrcpy$Window$CreateFileMessagePath$DirectoryGlobalSendSize$AllocBrushFreeLibraryLocalSolidVersionlstrcmpilstrlen$AppendAsyncCloseCommandCommonControlsCurrentEnabledEnumErrorExistsForegroundHandleIconicInitInitializeLineLoadModeModuleNameNumbersRegisterRelativeShowVisibleWindows
String ID: %USERPROFILE%\Desktop$*.*$1 2 3 4 5 0 8$TaskbarCreated
API String ID: 1839052441-4190804089
Opcode ID: 58bfa1753bffe7d0e1f770e55a34b8d7e9b7f547a47433f54d2a60854ece1719
Instruction ID: f00ae4c7dc319b9047b7417f3171913cc5cd1892ad5be35971a89e6c68a4c07b
Opcode Fuzzy Hash: 58bfa1753bffe7d0e1f770e55a34b8d7e9b7f547a47433f54d2a60854ece1719
Instruction Fuzzy Hash: 11415B74911394DAD754AFB2AD8A71A3FB0FF08754F00442BE9948F2A1EBB9A040DF53

Uniqueness

Uniqueness Score: -1.00%

Function 02A4CB30 Relevance: 33.6, APIs: 3, Strings: 16, Instructions: 388COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000000,00000000,00000104,00000000,7E6776EF,00000000,00000000), ref: 02A4DC09

Strings

9, xrefs: 02A4DF4F
vg~, xrefs: 02A4DFE0, 02A4DFE3
vices, xrefs: 02A4C419
|, xrefs: 02A4DC11
*, xrefs: 02A4DF56
-file, xrefs: 02A4C8D9
.7878kr5jx, xrefs: 02A4DF13
_, xrefs: 02A4DF3F
-bomb, xrefs: 02A4C36D
<, xrefs: 02A4DF64
-threads, xrefs: 02A4C9DF
cesses, xrefs: 02A4CA7D
+, xrefs: 02A4DF5D
-nomutex, xrefs: 02A4C7DD
ivate, xrefs: 02A4C4A9
1, xrefs: 02A4DF6B

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: PathTemp
String ID: vg~$*$+$-bomb$-file$-nomutex$-threads$.7878kr5jx$1$9$<$_$cesses$ivate$vices$|
API String ID: 2920410445-3367890932
Opcode ID: e9625a64e57258cc93158bab4cf924815d584a7d5e3209957dfc7563be40010c
Instruction ID: 6dacd3c5669b33de6db7255844b6caffdc8e3696eb439092dfd22788c8da1be4
Opcode Fuzzy Hash: e9625a64e57258cc93158bab4cf924815d584a7d5e3209957dfc7563be40010c
Instruction Fuzzy Hash: 6FE1AD70900208DFDB14DFA4D958BEEBBB5FF48304F10465DE919AB680EB74AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 007EFF10 Relevance: 30.1, APIs: 20, Instructions: 137
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32(007EFE70,00000000), ref: 007EFF51
IsWindowEnabled.USER32(00000000), ref: 007EFF64
IsIconic.USER32(00000000), ref: 007EFF76
ShowWindowAsync.USER32(00000009,00000009), ref: 007EFF86
IsWindowVisible.USER32(00000000), ref: 007EFF90
SendMessageW.USER32(00000400,00000400,00000000,00000203), ref: 007EFFB0
SendMessageW.USER32(00000400,00000400,00000000,00000202), ref: 007EFFC2
SetForegroundWindow.USER32(00000000), ref: 007EFFC8
GlobalSize.KERNEL32(?), ref: 007EFFDC
PathIsRelativeW.SHLWAPI ref: 007EFFF7
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 007F000B
PathAppendW.SHLWAPI(?), ref: 007F001C
lstrcpyW.KERNEL32(?), ref: 007F002D
GlobalSize.KERNEL32 ref: 007F0041
SendMessageW.USER32(?,0000004A,00000000,?), ref: 007F0061
GlobalFree.KERNEL32 ref: 007F0069
LoadStringW.USER32(0000C35F,?,00000100), ref: 007F00A5
LoadStringW.USER32(0000C35F,?,00000100), ref: 007F00C0
StrChrW.SHLWAPI(?,0000000A), ref: 007F00C9
MessageBoxW.USER32(00000000,00000000,?,00010024), ref: 007F00E8

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MessageWindow$GlobalSend$LoadPathSizeString$AppendAsyncCurrentDirectoryEnabledEnumForegroundFreeIconicRelativeShowVisibleWindowslstrcpy
String ID:
API String ID: 648661597-0
Opcode ID: a50b2123ed3d84790da7e3f3c107e2b30fa3afc45a63999132794719f373abd0
Instruction ID: a2e6c40b27a901059664fcf55feb9eec5a9267461ae70722f064a48b67fca27c
Opcode Fuzzy Hash: a50b2123ed3d84790da7e3f3c107e2b30fa3afc45a63999132794719f373abd0
Instruction Fuzzy Hash: AF518C74644345AFE720DF20DC49BAA7BE8FB58701F004429F685D62F1DBB8D844DB92

Uniqueness

Uniqueness Score: -1.00%

Function 02A7ECB0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 123
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,7E6776EF,02B16E58,00000000,?), ref: 02A7ECF5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,02AE500D,000000FF,?,02A7F400), ref: 02A7ECFB
CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000008), ref: 02A7ED0F
CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000028), ref: 02A7ED20
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,02AE500D,000000FF), ref: 02A7ED45

Strings

Crypto++ RNG, xrefs: 02A7ED07, 02A7ED1A
CryptAcquireContext, xrefs: 02A7ED4B

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: AcquireContextCrypt$ErrorLast
String ID: CryptAcquireContext$Crypto++ RNG
API String ID: 2779411412-1159690233
Opcode ID: 479e238f419ca97c0bd7fa413c8c42e929016174b6fa3a7b397851ff581d1d77
Instruction ID: 06442a521e05b325dfce9981fd62ac524876f350054c3616053ef5a48a538ab5
Opcode Fuzzy Hash: 479e238f419ca97c0bd7fa413c8c42e929016174b6fa3a7b397851ff581d1d77
Instruction Fuzzy Hash: CD417372A40309BBDB10DF94CD45F9AB7ECFB44710F104A6AF516A7680EFB4A505CB64

Uniqueness

Uniqueness Score: -1.00%

Function 02A7F390 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptGenRandom.ADVAPI32(00000000,?,00000000,00000001), ref: 02A7F410
CryptReleaseContext.ADVAPI32(?,00000000), ref: 02A7F42F

Part of subcall function 02A7EE10: GetLastError.KERNEL32(7E6776EF,7638F540,?), ref: 02A7EE58

Part of subcall function 02AB2B74: RaiseException.KERNEL32(E06D7363,00000001,00000003,02A4FBDC,?,?,?,?,02A4FBDC,?,02B04280), ref: 02AB2BD4

Strings

CryptGenRandom, xrefs: 02A7F478

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: Crypt$ContextErrorExceptionLastRaiseRandomRelease
String ID: CryptGenRandom
API String ID: 2561026028-3616286655
Opcode ID: 26cf0372e8cb3492588b4b3a96824f61bc39372c6c4a3f50c104b25d2e886224
Instruction ID: eec19a37a258bd38390fb7a0bc49d41e73ee176218ed8ad475b946fdc1408514
Opcode Fuzzy Hash: 26cf0372e8cb3492588b4b3a96824f61bc39372c6c4a3f50c104b25d2e886224
Instruction Fuzzy Hash: 4E318F71D40248AFDB11DFA4CD88BEEBBB9FF14714F000569E812A7281DF74AA09CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02A7F280 Relevance: 1.6, APIs: 1, Instructions: 84encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 02A7F30C

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: 9111ed6eb37c793a8c51df91a16818408ad7a224edc042cb59b7e377cec5ad74
Instruction ID: ac07c7ec1e41c0db71e1666d78be403f9c28bd65ae54918c11147de2847d811f
Opcode Fuzzy Hash: 9111ed6eb37c793a8c51df91a16818408ad7a224edc042cb59b7e377cec5ad74
Instruction Fuzzy Hash: 47210775E90300DFEB20CB18DD45B69B3E8EB05B60F10096AE919D3780EF35DA01DAD4

Uniqueness

Uniqueness Score: -1.00%

Function 007D4740 Relevance: 91.2, APIs: 47, Strings: 5, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpiW.KERNEL32(008E8DE8,0085D624,75AFB1B0), ref: 007D475F
lstrcpyW.KERNEL32(C:\Users\user\Desktop\HkObDPju6Z.ini,0085D420), ref: 007D4779
lstrcpyW.KERNEL32(008E8DE8,0085D420), ref: 007D4785
PathIsDirectoryW.SHLWAPI(008E8DE8), ref: 007D47AD
lstrlenW.KERNEL32(008E8DE8), ref: 007D47CA
CharPrevW.USER32(008E8DE8,00000000), ref: 007D47DD
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 007D47F9
PathFindFileNameW.SHLWAPI(?), ref: 007D4804
PathAppendW.SHLWAPI(008E8DE8,00000000), ref: 007D480C
PathRenameExtensionW.SHLWAPI(008E8DE8,.ini), ref: 007D481C
PathFileExistsW.SHLWAPI(008E8DE8), ref: 007D4827
PathIsDirectoryW.SHLWAPI(008E8DE8), ref: 007D4832
PathFindFileNameW.SHLWAPI(008E8DE8,minipath.ini), ref: 007D4842
lstrcpyW.KERNEL32(00000000), ref: 007D4845
PathFileExistsW.SHLWAPI(008E8DE8), ref: 007D484C
PathIsDirectoryW.SHLWAPI(008E8DE8), ref: 007D4857
PathFindFileNameW.SHLWAPI(?), ref: 007D4862
PathFindFileNameW.SHLWAPI(008E8DE8), ref: 007D486B
lstrcpyW.KERNEL32(00000000,00000000), ref: 007D486F
PathRenameExtensionW.SHLWAPI(008E8DE8,.ini), ref: 007D487B
PathIsDirectoryW.SHLWAPI(008E8BE0), ref: 007D488C
lstrlenW.KERNEL32(008E8BE0), ref: 007D4897
CharPrevW.USER32(008E8BE0,00000000), ref: 007D48AA
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 007D48C6
PathRemoveFileSpecW.SHLWAPI(?), ref: 007D48D1
lstrcatW.KERNEL32(?,\Notepad3.exe), ref: 007D48E1
PathFindFileNameW.SHLWAPI(?), ref: 007D48EC
PathAppendW.SHLWAPI(008E8BE0,00000000), ref: 007D48F4
PathRenameExtensionW.SHLWAPI(008E8BE0,.ini), ref: 007D4904

Strings

notepad3.ini, xrefs: 007D4920
.ini, xrefs: 007D4812, 007D4871, 007D48FA, 007D4959
C:\Users\user\Desktop\HkObDPju6Z.ini, xrefs: 007D4774, 007D49BE
minipath.ini, xrefs: 007D4838
\Notepad3.exe, xrefs: 007D48D7

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Path$File$Name$Find$Directorylstrcpy$ExtensionRename$AppendCharExistsModulePrevlstrlen$RemoveSpeclstrcatlstrcmpi
String ID: .ini$C:\Users\user\Desktop\HkObDPju6Z.ini$\Notepad3.exe$minipath.ini$notepad3.ini
API String ID: 882991028-3284174109
Opcode ID: 05bb978d13ff6b8b370d935f706c85948cc58ddbd406b703a550a37da4c9cc96
Instruction ID: 893cdcde7f323451b98852090bdcb5be720ba3c3739a48964ff1dfc4ca18024e
Opcode Fuzzy Hash: 05bb978d13ff6b8b370d935f706c85948cc58ddbd406b703a550a37da4c9cc96
Instruction Fuzzy Hash: 62515175B40349EFD6106BB79C46D2E36A8FF96B91B010415B928E33D0DEB8D8058676

Uniqueness

Uniqueness Score: -1.00%

Function 007D4160 Relevance: 42.1, APIs: 23, Strings: 1, Instructions: 145
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,75A94E60,775DF670,?,75A9A6C0), ref: 007D418A
PathIsRelativeW.SHLWAPI(?,?,75A9A6C0), ref: 007D4198
lstrcpyW.KERNEL32(?,?), ref: 007D41B2
PathFindFileNameW.SHLWAPI(?,?,?,75A9A6C0), ref: 007D41C1
lstrcpyW.KERNEL32(00000000), ref: 007D41C8
PathFileExistsW.KERNELBASE(?,?,75A9A6C0), ref: 007D41CF
PathIsDirectoryW.SHLWAPI(?), ref: 007D41E4
lstrcpyW.KERNEL32(?,?), ref: 007D41F4
PathRemoveFileSpecW.SHLWAPI(?,?,75A9A6C0), ref: 007D41FB
lstrcatW.KERNEL32(?,\np3\), ref: 007D4211
lstrcatW.KERNEL32(?,?), ref: 007D4220
PathFileExistsW.KERNELBASE(?,?,75A9A6C0), ref: 007D4227
PathIsDirectoryW.SHLWAPI(?), ref: 007D4236
SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?,?,75A9A6C0), ref: 007D424F
PathAppendW.SHLWAPI(?,?,?,75A9A6C0), ref: 007D4262
PathFileExistsW.KERNELBASE(?,?,75A9A6C0), ref: 007D426D
PathIsDirectoryW.SHLWAPI(?), ref: 007D427C
SHGetFolderPathW.SHELL32(00000000,00000028,00000000,00000000,?,?,75A9A6C0), ref: 007D428F
PathAppendW.SHLWAPI(?,?,?,75A9A6C0), ref: 007D42A2
lstrcpyW.KERNEL32(?,?), ref: 007D42BB
PathFileExistsW.SHLWAPI(?,?,75A9A6C0), ref: 007D42CC
PathIsDirectoryW.SHLWAPI(?), ref: 007D42DE
lstrcpyW.KERNEL32(?,?), ref: 007D42F1

Strings

\np3\, xrefs: 007D420B

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Path$File$lstrcpy$DirectoryExists$AppendFolderlstrcat$EnvironmentExpandFindNameRelativeRemoveSpecStrings
String ID: \np3\
API String ID: 3472113900-578766168
Opcode ID: ed75932cfd1d9a44ace0660c5a16ced65a03ba4e675cd9459c8c451e699858d2
Instruction ID: f4bf162888daae590dab0a5f9b663e1c7543459219830230a959e19c72fcd4c3
Opcode Fuzzy Hash: ed75932cfd1d9a44ace0660c5a16ced65a03ba4e675cd9459c8c451e699858d2
Instruction Fuzzy Hash: 3841FD7660434AABD720DFA0DC48FAB77ECBB54740F040C2ABA55C3250EB78E549CB62

Uniqueness

Uniqueness Score: -1.00%

Function 007E8850 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 67
registrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32(0000000B), ref: 007E8863
GetSystemMetrics.USER32(0000000C), ref: 007E8869
GetSystemMetrics.USER32(00000031), ref: 007E8870
GetSystemMetrics.USER32(00000032), ref: 007E8877
#381.COMCTL32(?,00000064,00000000,?,008E98C8), ref: 007E8899
#381.COMCTL32(?,00000064,00000008,00000000,008E92A0), ref: 007E88B3
LoadCursorW.USER32(?,00007F00), ref: 007E88E2
RegisterClassW.USER32(00002000), ref: 007E8904
LoadLibraryA.KERNELBASE(fdgmnfmfhdfgsndhfd), ref: 007E890F
#381.COMCTL32(00000000), ref: 007E8926
ExitProcess.KERNEL32 ref: 007E892A

Strings

MiniPath, xrefs: 007E88FD
fdgmnfmfhdfgsndhfd, xrefs: 007E890A

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MetricsSystem$#381$Load$ClassCursorExitLibraryProcessRegister
String ID: MiniPath$fdgmnfmfhdfgsndhfd
API String ID: 2339817912-2455953222
Opcode ID: 1b6c4c5b7c525687c1ac07f39e94427448fe58eac6ed2ac38391689fda46cb5a
Instruction ID: 3bd2ce3f931eb82dcd099c5fb39a6e05af819adc0904fdd6c086fa4b73a7f9b9
Opcode Fuzzy Hash: 1b6c4c5b7c525687c1ac07f39e94427448fe58eac6ed2ac38391689fda46cb5a
Instruction Fuzzy Hash: E7213A74D40318BBEB109FA5DC49B9E7FB9FB09714F00002AE604AB290DBF95904CF91

Uniqueness

Uniqueness Score: -1.00%

Function 007F2983 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 214
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?,?,?,00000000), ref: 007F2A07
LoadLibraryExA.KERNELBASE(?,00000000,00000000,?,?,00000000), ref: 007F2A93
GetLastError.KERNEL32 ref: 007F2A9F
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 007F2ADF

Strings

$, xrefs: 007F299B

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: 20aa4868d2e68787d200fb62155ba5e416b7c4ded67912df6a4e162a7d181b42
Instruction ID: 629aa128c64c708e32cae06f5a2538c20d659416f4e2756141422b66f6419c30
Opcode Fuzzy Hash: 20aa4868d2e68787d200fb62155ba5e416b7c4ded67912df6a4e162a7d181b42
Instruction Fuzzy Hash: 08819CB5901619AFDB11CF94C894ABEB7B9FF98310F15406AEE04AB351DB74DD02CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02AD4529 Relevance: 15.2, APIs: 10, Instructions: 188
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02ACF8C7: HeapFree.KERNEL32(00000000,00000000,?,02ADA9D3,?,00000000,?,?,02ADAC74,?,00000007,?,?,02ADB16D,?,?), ref: 02ACF8DD
Part of subcall function 02ACF8C7: GetLastError.KERNEL32(?,?,02ADA9D3,?,00000000,?,?,02ADAC74,?,00000007,?,?,02ADB16D,?,?), ref: 02ACF8E8

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02AD465A
GetExitCodeProcess.KERNELBASE(?,?), ref: 02AD4667
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02AD467C
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02AD4687
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02AD4692
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02AD46A4
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02AD46AF
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02AD46C1
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02AD46CC
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 02AD46FD

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: CloseHandle$ErrorLast$CodeExitFreeHeapObjectProcessSingleWait
String ID:
API String ID: 3916219118-0
Opcode ID: f9b20092eb3c7ce37927a722e70e904641c590e92dac47e5fc4138cc7c591e9b
Instruction ID: 383a7267b9601aa624e51c0cabb04a319bc338661d081501a7e323a16bf5f84c
Opcode Fuzzy Hash: f9b20092eb3c7ce37927a722e70e904641c590e92dac47e5fc4138cc7c591e9b
Instruction Fuzzy Hash: ED51B372D40209EFCF12AF90C984AEE7BBAFF44319F20446AE512BA150DF319A55DF61

Uniqueness

Uniqueness Score: -1.00%

Function 007D1E10 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 115
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlGetNtVersionNumbers.NTDLL(008E89AC,008E89A8,008E89B0), ref: 007D1E31
LoadLibraryExW.KERNEL32(comctl32.dll,00000000,00000800), ref: 007D1EB3
FreeLibrary.KERNEL32(00000000), ref: 007D1F01
VirtualProtect.KERNELBASE(00000000,00000004,00000004,?,?), ref: 007D1F49
VirtualProtect.KERNELBASE(00000000,00000004,?,?), ref: 007D1F6F
FreeLibrary.KERNEL32(00000000), ref: 007D1F73

Strings

comctl32.dll, xrefs: 007D1EAA
uxtheme.dll, xrefs: 007D1EE5

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Library$FreeProtectVirtual$LoadNumbersVersion
String ID: comctl32.dll$uxtheme.dll
API String ID: 1860271146-677055601
Opcode ID: 3fd287a51b758ab29ded1c477158eb5ef95d185f5fafa7790c15e9104da04bd3
Instruction ID: bfa7c1754685e14aaccfb7ccc25a8350d0359dd9b6d440e322fd8a24b786adba
Opcode Fuzzy Hash: 3fd287a51b758ab29ded1c477158eb5ef95d185f5fafa7790c15e9104da04bd3
Instruction Fuzzy Hash: 80412671605381EBDB209B68EC84B363BB4BB41345F48406AFD55DB362DB78D809C721

Uniqueness

Uniqueness Score: -1.00%

Function 02AD9395 Relevance: 6.1, APIs: 4, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 02AD939D

Part of subcall function 02AD540A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,02AD4ECC,?,00000000,-00000008), ref: 02AD54B6

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 02AD93D5
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 02AD93F5

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 54cd957e0e5cf8d2e11995a47925ba112dae796b803a1a7149147d494e529239
Instruction ID: 23f00762ec986c5fca98992b7d9af3bc50fba87ca5645a14bfde906976820598
Opcode Fuzzy Hash: 54cd957e0e5cf8d2e11995a47925ba112dae796b803a1a7149147d494e529239
Instruction Fuzzy Hash: 0111C4F2955516BFAB2127765DCCC7F6A6EEE852987210829F803D2100EF20EE028671

Uniqueness

Uniqueness Score: -1.00%

Function 007D25D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFileExistsW.KERNELBASE(C:\Windows\system32\Viewers\Quikview.exe,00000002,007D4EB9), ref: 007D25D4
PathIsDirectoryW.SHLWAPI(C:\Windows\system32\Viewers\Quikview.exe), ref: 007D25DF

Strings

C:\Windows\system32\Viewers\Quikview.exe, xrefs: 007D25D3, 007D25DE

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Path$DirectoryExistsFile
String ID: C:\Windows\system32\Viewers\Quikview.exe
API String ID: 1302732169-377476166
Opcode ID: 82d49885c91ac2870a27148a95df1668e84df1e4104403848c19fd52b63101e9
Instruction ID: 1664b8e85622ed8aa84ff8d6dd801b62dc4697c062c00d3b5b15ff2b1e6e8c43
Opcode Fuzzy Hash: 82d49885c91ac2870a27148a95df1668e84df1e4104403848c19fd52b63101e9
Instruction Fuzzy Hash: BDC012313155210EE7311F287D08BD7125CAF1221070901AAF406C6249FA58DD8391D5

Uniqueness

Uniqueness Score: -1.00%

Function 00837FDC Relevance: 3.0, APIs: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32(?,0082B3E5,?,0082B363,0082B31B), ref: 00837FDF
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,0082B3E5,?,0082B363,0082B31B), ref: 0083801E

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: d58bbbe1b0b448f67c0b467dbe898e079e007851bf0efc547ffc0ab167593fc9
Instruction ID: fe53d4eafee701bc58e20956718971ecd8d969fdb3e971516ecf58e9bad9e99d
Opcode Fuzzy Hash: d58bbbe1b0b448f67c0b467dbe898e079e007851bf0efc547ffc0ab167593fc9
Instruction Fuzzy Hash: 6DE0927B60AA212AD222323C7C5EE9F1A1DFFC6775F150266F520D6282EE548C0255F6

Uniqueness

Uniqueness Score: -1.00%

Function 02ADEA45 Relevance: 1.6, APIs: 1, Instructions: 89processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000001,?,?,?,00000000,?,00000000,00000001,00000000,?,?,?,?,00000000,?), ref: 02ADEAFA

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 132db9467eced02cc235e6465baad702e410471f8b3458f60dba6333f4d42bfa
Instruction ID: cec4d31ca97b2d93aa660ab2e7276e5320f4a9574c1538f85b12715c352c175b
Opcode Fuzzy Hash: 132db9467eced02cc235e6465baad702e410471f8b3458f60dba6333f4d42bfa
Instruction Fuzzy Hash: EF312CB2C01259AFCF119FA9DA849DEBFBABF08314F54802EE915B2111DB319955CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02ACF86A Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,02ACF71D,00000001,00000364,?,00000009,000000FF,?,?,02AC3F7F,02AD04F0), ref: 02ACF8AB

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d7398779a4ea478a55d502fadc1cf2c236bc28e00ae709fd9de5378297510b6a
Instruction ID: 1a72cf32b7b0861dc54e5efc90dc7ced8bd8db7036a02189fb1046b2f68c2043
Opcode Fuzzy Hash: d7398779a4ea478a55d502fadc1cf2c236bc28e00ae709fd9de5378297510b6a
Instruction Fuzzy Hash: 59F0B432548625AFAF216B629C44B6A379FEB41764B34802BAC14EA980CF20D40187E0

Uniqueness

Uniqueness Score: -1.00%

Function 00832AA4 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,0082FB8C,00000001,00000364,?,00000006,000000FF,?,?,0082F170,00830176), ref: 00832AE5

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 70591b6f87929e5a8dc78d7bd695311b80490c171ec8e7dba04f68bcd1b6fb7f
Instruction ID: a99ecef64f3821a4ff084aceb7f8e89b3d0a84bba9d902dbd4c311dae33131e5
Opcode Fuzzy Hash: 70591b6f87929e5a8dc78d7bd695311b80490c171ec8e7dba04f68bcd1b6fb7f
Instruction Fuzzy Hash: 2EF0B4315456357BDB31AB269C41A5A3748FFC1B60F144121FC04EA191CEB4DC8096E1

Uniqueness

Uniqueness Score: -1.00%

Function 02AD04AD Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,02AB14B7,?,?,02A41029,00000024,7E6776EF,?,02AE25D9,000000FF), ref: 02AD04DF

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d3bd827c7e223dab612c8e3b25f4cbaa20bff83062797fe5206166e567a5fc9f
Instruction ID: 211e31dc37478ce6dcb97bd9ba6c4926e631c1019843b9d7dc7df883ee682df1
Opcode Fuzzy Hash: d3bd827c7e223dab612c8e3b25f4cbaa20bff83062797fe5206166e567a5fc9f
Instruction Fuzzy Hash: 25E0E5B518022197EA316735AD54F6B3A59EB417B0F154415EC1BEA180CF10E80186F4

Uniqueness

Uniqueness Score: -1.00%

Function 00830133 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,007F2C1A,?,?,007D102A,00000024,634AD31B,?,?,0084D1AF,000000FF), ref: 00830165

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 32040dbfeaa647fedc82d967116d81272b29d80f4d16288d91ac2f4a5d18a324
Instruction ID: 13050bbc3584f91f6b0e1f1b80be26115dd21a8823f425bff6d1f37c2b14994d
Opcode Fuzzy Hash: 32040dbfeaa647fedc82d967116d81272b29d80f4d16288d91ac2f4a5d18a324
Instruction Fuzzy Hash: 09E0653520562597EA623B7D9C61B5E3658FFC2BA0F150130EC45DA292CBA0CC80D9E2

Uniqueness

Uniqueness Score: -1.00%

Function 02A9ABD1 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,02A4CA5C,?,00000000,811C9DC5,?,00000000,00000000,?,-file,00000005,00000000,00000000,?), ref: 02A9ABDB

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 45924fa9a112062e822123c635980e2aa60744bb373edbc67b537aa1d34575c1
Instruction ID: 13b0f313d6b39cec142c5081d1bfc8ef680ca5c080d485d4f6b01d6bbe063e68
Opcode Fuzzy Hash: 45924fa9a112062e822123c635980e2aa60744bb373edbc67b537aa1d34575c1
Instruction Fuzzy Hash: 97C09B74D0410DD7CF00E7E5D54D8CEB7FCB608208B400851D911E3140E670F95A87A1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 007EA800 Relevance: 160.3, APIs: 77, Strings: 14, Instructions: 1025windowlibrarystringCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(uxtheme.dll,634AD31B,75B03760,?), ref: 007EA87F
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 007EA891
FreeLibrary.KERNEL32(00000000), ref: 007EA8A4
CreateWindowExW.USER32(00000080,ToolbarWindow32,00000000,54001D68,00000000,00000000,00000000,00000000,?,000000A1,?,00000000), ref: 007EA8F2
SendMessageW.USER32(0000041E,00000014,00000000), ref: 007EA949
LoadImageW.USER32(?,00000064,00000000,00000000,00000000,00002000), ref: 007EA98B
CopyImage.USER32(00000000,00000000,00000000,00000000,00002000), ref: 007EA99F
GetObjectW.GDI32(00000000,00000018,?), ref: 007EA9BB
VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003), ref: 007EAA14
VerSetConditionMask.KERNEL32(00000000), ref: 007EAA18
VerSetConditionMask.KERNEL32(00000000), ref: 007EAA1C
VerifyVersionInfoW.KERNEL32(0000011C,00000023,00000000), ref: 007EAA46
GetSysColor.USER32(0000000F), ref: 007EAA52
ImageList_Create.COMCTL32(?,?,?,00000021,00000000,00000000), ref: 007EAA89
ImageList_AddMasked.COMCTL32(00000000,00000000,FF000000), ref: 007EAA98
DeleteObject.GDI32(00000000), ref: 007EAA9F
SendMessageW.USER32(00000430,00000000,00000000), ref: 007EAAB3
GetObjectW.GDI32(00000000,00000018,?), ref: 007EAAE3
ImageList_Create.COMCTL32(?,?,?,00000021,00000000,00000000), ref: 007EAB0D
ImageList_AddMasked.COMCTL32(00000000,00000000,FF000000), ref: 007EAB1C
DeleteObject.GDI32(00000000), ref: 007EAB23
SendMessageW.USER32(00000434,00000000,00000000), ref: 007EAB37
GetObjectW.GDI32(00000000,00000018,?), ref: 007EAB67
ImageList_Create.COMCTL32(?,?,?,00000021,00000000,00000000), ref: 007EAB91
ImageList_AddMasked.COMCTL32(00000000,00000000,FF000000), ref: 007EABA0
DeleteObject.GDI32(00000000), ref: 007EABA7
SendMessageW.USER32(00000436,00000000,00000000), ref: 007EABBB
GetSysColor.USER32(0000000F), ref: 007EABE8
GetObjectW.GDI32(00000000,00000018,?), ref: 007EAC03
VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003), ref: 007EAD49
VerSetConditionMask.KERNEL32(00000000), ref: 007EAD4D
VerSetConditionMask.KERNEL32(00000000), ref: 007EAD51
VerifyVersionInfoW.KERNEL32(0000011C,00000023,00000000), ref: 007EAD7B
GetObjectW.GDI32(00000000,00000018,?), ref: 007EADA4
VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003), ref: 007EAEB8
VerSetConditionMask.KERNEL32(00000000), ref: 007EAEBC
VerSetConditionMask.KERNEL32(00000000), ref: 007EAEC0
VerifyVersionInfoW.KERNEL32(0000011C,00000023,00000000), ref: 007EAEEA
GetSysColor.USER32(0000000F), ref: 007EAEF6
ImageList_Create.COMCTL32(?,?,?,00000021,00000000,00000000), ref: 007EAF3F
ImageList_AddMasked.COMCTL32(00000000,00000000,FF000000), ref: 007EAF4E
SendMessageW.USER32(00000436,00000000,00000000), ref: 007EAF62
DeleteObject.GDI32(00000000), ref: 007EAF73
wsprintfW.USER32 ref: 007EAFC3
lstrcmpiW.KERNEL32(?,(none)), ref: 007EB000
lstrcmpiW.KERNEL32(?,(none)), ref: 007EB020
SendMessageW.USER32(0000044D,00000000,?), ref: 007EB057
SendMessageW.USER32(00000455,00000000,00000000), ref: 007EB0AC
SendMessageW.USER32(00000454,00000000,00000000), ref: 007EB0BF
SendMessageW.USER32(00000444,00000006,008E71F0), ref: 007EB0D3
SendMessageW.USER32(00000444,00000006,008E71F0), ref: 007EB0FB
SendMessageW.USER32(0000041D,00000000,?), ref: 007EB111
CreateWindowExW.USER32(02000000,msctls_statusbar32,00000000,44000000,00000000,00000000,00000000,00000000,?,000000A0,?,00000000), ref: 007EB145
SystemParametersInfoW.USER32(00000042,0000000C,0000000C,00000000), ref: 007EB19C
CreateWindowExW.USER32(00000080,ReBarWindow32,00000000,?,00000000,00000000,00000000,00000000,?,000000A2,?,00000000), ref: 007EB23E
VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003), ref: 007EB2A0
VerSetConditionMask.KERNEL32(00000000), ref: 007EB2A4
VerSetConditionMask.KERNEL32(00000000), ref: 007EB2A8
VerifyVersionInfoW.KERNEL32(0000011C,00000023,00000000), ref: 007EB2D2

Strings

Explorer, xrefs: 007EA8FF, 007EB152, 007EB2F4
3, xrefs: 007EB3C3
, xrefs: 007EADAE
d, xrefs: 007EB3B9
333, xrefs: 007EB5DB
%02i, xrefs: 007EAFB7
ToolbarWindow32, xrefs: 007EA8E8
msctls_statusbar32, xrefs: 007EB13B
(none), xrefs: 007EAFF4, 007EB014
ReBarWindow32, xrefs: 007EB234
uxtheme.dll, xrefs: 007EA87A
1 2 3 4 5 0 8, xrefs: 007EB0D8
IsAppThemed, xrefs: 007EA88B
Toolbar Labels, xrefs: 007EAFE3

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ConditionMask$MessageSend$Image$Object$List_$Create$Info$DeleteMaskedVerifyVersion$ColorWindow$LibraryLoadlstrcmpi$AddressCopyFreeParametersProcSystemwsprintf
String ID: $%02i$(none)$1 2 3 4 5 0 8$3$333$Explorer$IsAppThemed$ReBarWindow32$Toolbar Labels$ToolbarWindow32$d$msctls_statusbar32$uxtheme.dll
API String ID: 3633255068-1335592371
Opcode ID: 5ff6f83ee0ca5bb5af074d89365ed29f7fba6a90125cadc8775531673b770094
Instruction ID: 401f27fba8752a6fd2d49102a6a28e1f086322a029dc9c2b17c50cbf1c37e076
Opcode Fuzzy Hash: 5ff6f83ee0ca5bb5af074d89365ed29f7fba6a90125cadc8775531673b770094
Instruction Fuzzy Hash: 8E82C670A41798AEEB308B65DC49FAB7BB4FB48705F044099F608EA1D1DBB49E84CF15

Uniqueness

Uniqueness Score: -1.00%

Function 02A9E195 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 02A9E19B
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 02A9E1A9
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 02A9E1BA
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 02A9E1CB
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 02A9E1DC
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 02A9E1ED
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 02A9E1FE
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 02A9E20F
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 02A9E220
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 02A9E231
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 02A9E242
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 02A9E253
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 02A9E264
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 02A9E275
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 02A9E286
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 02A9E297
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 02A9E2A8
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 02A9E2B9
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 02A9E2CA
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 02A9E2DB
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 02A9E2EC
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 02A9E2FD
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 02A9E30E
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 02A9E31F
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 02A9E330
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 02A9E341
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 02A9E352
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 02A9E363
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 02A9E374
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 02A9E385
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 02A9E396
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 02A9E3A7
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 02A9E3B8
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 02A9E3C9
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 02A9E3DA
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 02A9E3EB
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 02A9E3FC
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 02A9E40D
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 02A9E41E
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 02A9E42F
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 02A9E440

Strings

LCMapStringEx, xrefs: 02A9E435
SleepConditionVariableCS, xrefs: 02A9E37A
WakeConditionVariable, xrefs: 02A9E358
InitializeSRWLock, xrefs: 02A9E38B
CreateThreadpoolWork, xrefs: 02A9E3E0
CreateThreadpoolWait, xrefs: 02A9E27B
CreateEventExW, xrefs: 02A9E204
CreateThreadpoolTimer, xrefs: 02A9E237
GetCurrentPackageId, xrefs: 02A9E2F2
TryAcquireSRWLockExclusive, xrefs: 02A9E3AD
SetFileInformationByHandle, xrefs: 02A9E325
InitializeConditionVariable, xrefs: 02A9E347
AcquireSRWLockExclusive, xrefs: 02A9E39C
SetThreadpoolTimer, xrefs: 02A9E248
FlsSetValue, xrefs: 02A9E1D1
SubmitThreadpoolWork, xrefs: 02A9E3F1
kernel32.dll, xrefs: 02A9E196
GetTickCount64, xrefs: 02A9E303
FlsAlloc, xrefs: 02A9E1A3
FreeLibraryWhenCallbackReturns, xrefs: 02A9E2BF
FlushProcessWriteBuffers, xrefs: 02A9E2AE
InitializeCriticalSectionEx, xrefs: 02A9E1E2
ReleaseSRWLockExclusive, xrefs: 02A9E3BE
WakeAllConditionVariable, xrefs: 02A9E369
CreateSemaphoreExW, xrefs: 02A9E226
CreateSemaphoreW, xrefs: 02A9E215
CloseThreadpoolTimer, xrefs: 02A9E26A
CreateSymbolicLinkW, xrefs: 02A9E2E6
InitOnceExecuteOnce, xrefs: 02A9E1F3
FlsFree, xrefs: 02A9E1AF
CloseThreadpoolWait, xrefs: 02A9E29D
GetSystemTimePreciseAsFileTime, xrefs: 02A9E336
SleepConditionVariableSRW, xrefs: 02A9E3CF
GetLocaleInfoEx, xrefs: 02A9E424
GetCurrentProcessorNumber, xrefs: 02A9E2D0
CloseThreadpoolWork, xrefs: 02A9E402
WaitForThreadpoolTimerCallbacks, xrefs: 02A9E259
CompareStringEx, xrefs: 02A9E413
SetThreadpoolWait, xrefs: 02A9E28C
GetFileInformationByHandleEx, xrefs: 02A9E314
FlsGetValue, xrefs: 02A9E1C0

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: c465812afd8e8b7dc1887a88dc842d3dced575e850eec921b562c51e06fbee68
Instruction ID: 5123ec819817a9cb6be8672c7f250635306277cbefe7dc7d0d8d13209399f45e
Opcode Fuzzy Hash: c465812afd8e8b7dc1887a88dc842d3dced575e850eec921b562c51e06fbee68
Instruction Fuzzy Hash: 25614672DD1319FBFB806FF4B84D8567BA8BA197553984D1EF202D7105EFB880268B60

Uniqueness

Uniqueness Score: -1.00%

Function 007EBE50 Relevance: 111.1, APIs: 60, Strings: 3, Instructions: 880windowCOMMON

Download Yara Rule

APIs

DialogBoxIndirectParamW.USER32(?,00000000,?,Function_0000DC80,00000000), ref: 007EC0F3
LocalFree.KERNEL32(00000000,?,Function_0000DC80,00000000), ref: 007EC102
ShellExecuteExW.SHELL32(?), ref: 007EC1CB
GetShortPathNameW.KERNEL32(?,?,00000104), ref: 007EC291
StrCatBuffW.SHLWAPI(?,008EC36C,00000104,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 007EC2B9
StrCatBuffW.SHLWAPI(?,0085DDEC,00000104,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 007EC2CD
StrCatBuffW.SHLWAPI(?,?,00000104,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 007EC2E4
SendMessageW.USER32(?,00000111,00019D0E,00000000), ref: 007EE1A4

Strings

, xrefs: 007ED67A
<, xrefs: 007EC198
C:\Windows\system32\Viewers\Quikview.exe, xrefs: 007EC2ED

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Buff$DialogExecuteFreeIndirectLocalMessageNameParamPathSendShellShort
String ID: $<$C:\Windows\system32\Viewers\Quikview.exe
API String ID: 1759457118-124786596
Opcode ID: 426bfe754641347ca71efac2d94c810e63375d3cc7771f595d306c234a85d917
Instruction ID: 81f6be74bb0016f1225f3fbe8aeb1a0b9b83aba4d84a1eab7dd8dfbc3f8be8e7
Opcode Fuzzy Hash: 426bfe754641347ca71efac2d94c810e63375d3cc7771f595d306c234a85d917
Instruction Fuzzy Hash: 87625B706053C4DBE730DB22DC4AFAB77A8BB89700F144929F649871E1EBB89945CB53

Uniqueness

Uniqueness Score: -1.00%

Function 007E8FD0 Relevance: 105.7, APIs: 56, Strings: 4, Instructions: 657timewindowCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,0000A000,00000000,00000000), ref: 007E9074
KillTimer.USER32(?,0000A000), ref: 007E90AE
FindCloseChangeNotification.KERNEL32 ref: 007E90BA
GetWindowPlacement.USER32(?,?), ref: 007E90CE
DragAcceptFiles.SHELL32(?,00000000), ref: 007E910C
LocalFree.KERNEL32(00000000), ref: 007E9127
PostQuitMessage.USER32(00000000), ref: 007E9167
IsWindowVisible.USER32(?), ref: 007EA021

Strings

Settings2, xrefs: 007E9057
AutoRefreshRate, xrefs: 007E9052
1 2 3 4 5 0 8, xrefs: 007E913B, 007E9F76
,, xrefs: 007E90C4

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: TimerWindow$AcceptChangeCloseDragFilesFindFreeKillLocalMessageNotificationPlacementPostQuitVisible
String ID: ,$1 2 3 4 5 0 8$AutoRefreshRate$Settings2
API String ID: 1545102215-3278632014
Opcode ID: 8ff7ae2190e431756f22471636efd45dfa36bee85f9b4dcaa387b6409fc8104e
Instruction ID: 32f5c3f0127240f579065cba62b6313a5d2bcf7c6b1d5b24e83beaf001ae58ba
Opcode Fuzzy Hash: 8ff7ae2190e431756f22471636efd45dfa36bee85f9b4dcaa387b6409fc8104e
Instruction Fuzzy Hash: 74223D36305284AFD724AF24EC4AFBE37A9FBC9710F04451AF645962E1EB786801D793

Uniqueness

Uniqueness Score: -1.00%

Function 007EA240 Relevance: 84.3, APIs: 39, Strings: 9, Instructions: 349windowlibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 007EA800: LoadLibraryW.KERNEL32(uxtheme.dll,634AD31B,75B03760,?), ref: 007EA87F
Part of subcall function 007EA800: GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 007EA891
Part of subcall function 007EA800: FreeLibrary.KERNEL32(00000000), ref: 007EA8A4
Part of subcall function 007EA800: CreateWindowExW.USER32(00000080,ToolbarWindow32,00000000,54001D68,00000000,00000000,00000000,00000000,?,000000A1,?,00000000), ref: 007EA8F2
Part of subcall function 007EA800: SendMessageW.USER32(0000041E,00000014,00000000), ref: 007EA949
Part of subcall function 007EA800: GetObjectW.GDI32(00000000,00000018,?), ref: 007EA9BB

CreateWindowExW.USER32(00000200,SysListView32,00000000,5600414D,00000000,00000000,00000000,00000000,?,0000A001,?,00000000), ref: 007EA2D1
LoadLibraryW.KERNEL32(uxtheme.dll), ref: 007EA2E3
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 007EA2F5
FreeLibrary.KERNEL32(00000000), ref: 007EA304
GetWindowLongW.USER32(000000EC), ref: 007EA316
SetWindowLongW.USER32(000000EC,00000000), ref: 007EA32A
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000027), ref: 007EA342
SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 007EA39E
#410.COMCTL32(?,007D1550,00000000,00000000), ref: 007EA3C6
SendMessageW.USER32(?,00001036,00000000,00010030), ref: 007EA3D9
SendMessageW.USER32(?,00000127,00010001,00000000), ref: 007EA3E8
SendMessageW.USER32(00001036,00000000,00014000), ref: 007EA41E
SendMessageW.USER32(00001061,00000000,00000005), ref: 007EA432
SendMessageW.USER32(00001036,00000048,00000048), ref: 007EA44C
SendMessageW.USER32(00001036,00000020,00000020), ref: 007EA466
SendMessageW.USER32(00001047,00000000,0000000A), ref: 007EA486
GetSystemMetrics.USER32(00000011), ref: 007EA4AA
CreateWindowExW.USER32(00000000,ComboBoxEx32,00000000,44200003,00000000,00000000,00000000,00000000), ref: 007EA4C1
SendMessageW.USER32(?,0000200B,00000000,Explorer), ref: 007EA514
SendMessageW.USER32(?,00000155,00000001,00000000), ref: 007EA520
SHGetFileInfoW.SHELL32(C:\,00000000,?,000002B4,00004001), ref: 007EA552
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 007EA561
SendMessageW.USER32(?,0000040E,00000008,00000008), ref: 007EA56D
SendMessageW.USER32(?,0000040E,00000020,00000020), ref: 007EA579
DragAcceptFiles.SHELL32(?,00000001), ref: 007EA57E
SendMessageW.USER32(?,?,00000423,00000000), ref: 007EA60E
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 007EA61D
GetSystemMenu.USER32(?,00000000,?,?,00000423,00000000,00000000), ref: 007EA622
DeleteMenu.USER32(00000000,0000F120,00000000,?,?,00000423,00000000,00000000), ref: 007EA638
DeleteMenu.USER32(00000000,0000F030,00000000,?,?,00000423,00000000,00000000), ref: 007EA642
GetMenuItemInfoW.USER32(00000000,0000F020,00000000,?), ref: 007EA661
SetMenuItemInfoW.USER32(00000000,0000F020,00000000,00000030), ref: 007EA67C
LoadStringW.USER32(0000EA61,?,00000040), ref: 007EA69D
LoadStringW.USER32(0000EA61,?,00000040), ref: 007EA6B8
InsertMenuW.USER32(00000000,0000F010,00000000,0000EA61,?), ref: 007EA6D5
LoadStringW.USER32(0000EA62,?,00000040), ref: 007EA6EC
LoadStringW.USER32(0000EA62,?,00000040), ref: 007EA707
InsertMenuW.USER32(00000000,0000F060,00000000,0000EA62,?), ref: 007EA71E
InsertMenuW.USER32(00000000,0000F060,00000800,00000000,00000000), ref: 007EA72F

Strings

Explorer, xrefs: 007EA350, 007EA46A, 007EA4C9, 007EA507
ItemsView, xrefs: 007EA3EC, 007EA3F9
0, xrefs: 007EA5B8
ComboBoxEx32, xrefs: 007EA4BA
C:\, xrefs: 007EA54D
uxtheme.dll, xrefs: 007EA2D7
IsAppThemed, xrefs: 007EA2EF
0, xrefs: 007EA648
SysListView32, xrefs: 007EA2C7

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MessageSend$Menu$LoadWindow$LibraryString$CreateInfoInsert$AddressDeleteFreeItemLongProcSystem$#410AcceptDragFileFilesMetricsObject
String ID: 0$0$C:\$ComboBoxEx32$Explorer$IsAppThemed$ItemsView$SysListView32$uxtheme.dll
API String ID: 1504807357-4163490857
Opcode ID: 09ba61495cd92122900df8d2286db3479238344812acdc0e83faa167c2969ad1
Instruction ID: 08921bb9e4d001600e5da1995424e9257fa7a8b0b1e79248eec5fc8fb6f46c6a
Opcode Fuzzy Hash: 09ba61495cd92122900df8d2286db3479238344812acdc0e83faa167c2969ad1
Instruction Fuzzy Hash: 02C1B070284381BBF3319B60DC8AF6A3BA8BB96B04F144518F7407E1E0D7F5A544CB2A

Uniqueness

Uniqueness Score: -1.00%

Function 007F04A0 Relevance: 73.9, APIs: 40, Strings: 2, Instructions: 406stringwindowmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(008E9CF8,008E92B0), ref: 007F050D
EnumWindows.USER32(007F01F0,00000000), ref: 007F051D
IsWindowEnabled.USER32(00000000), ref: 007F0530
IsIconic.USER32(00000000), ref: 007F0542
ShowWindowAsync.USER32(00000009,00000009), ref: 007F0552
SetForegroundWindow.USER32(00000000), ref: 007F0565
lstrlenW.KERNEL32(?), ref: 007F0574
GlobalAlloc.KERNEL32(00002042,00000000), ref: 007F0587
GlobalLock.KERNEL32(00000000), ref: 007F0594
lstrcpyW.KERNEL32(-00000014,?), ref: 007F05C5
GlobalUnlock.KERNEL32(00000000), ref: 007F05C8
PostMessageW.USER32(00000233,00000233,00000000,00000000), ref: 007F05DA
StrChrW.SHLWAPI(?,0000000A,?,?), ref: 007F0624
MessageBoxW.USER32(00000000,?,00010024), ref: 007F064A
GetShortPathNameW.KERNEL32(?,?,00000104), ref: 007F068C
StrCpyNW.SHLWAPI(?,008E98D0,00000104), ref: 007F06B1
StrCatBuffW.SHLWAPI(?,0085DDEC,00000104), ref: 007F06C6
StrCatBuffW.SHLWAPI(?,?,00000104), ref: 007F06D3
lstrcpyW.KERNEL32(?,008E96C0), ref: 007F06E2
ShellExecuteExW.SHELL32 ref: 007F0763

Part of subcall function 007E4FE0: LoadStringW.USER32(0000A411,?,00000000,00000001), ref: 007E4FF2
Part of subcall function 007E4FE0: LoadStringW.USER32(0000A411,?,?), ref: 007E5008

lstrcpynW.KERNEL32(?,008E9AE0,00000100), ref: 007F0803
wsprintfW.USER32 ref: 007F083C
DdeInitializeW.USER32(?,007E6930,00000010,00000000), ref: 007F0853
DdeCreateStringHandleW.USER32(?,008E90A0,000004B0), ref: 007F0875
DdeCreateStringHandleW.USER32(?,008E94C0,000004B0), ref: 007F0887
DdeConnect.USER32(?,00000000,00000000,00000000), ref: 007F08A0
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00004050,000000FF,00000000,?,?,?,?,?,?,?,?,?), ref: 007F08C4
DdeClientTransaction.USER32(?,00000000), ref: 007F08DA
DdeDisconnect.USER32(?), ref: 007F08E4
DdeUninitialize.USER32(?), ref: 007F0919
GetShortPathNameW.KERNEL32(?,?,00000104), ref: 007F0970
StrCpyNW.SHLWAPI(?,008E98D0,00000104,?,?,?,?), ref: 007F0998
StrCatBuffW.SHLWAPI(?,0085DDEC,00000104,?,?,?,?), ref: 007F09B0
StrCatBuffW.SHLWAPI(?,?,00000104,?,?,?,?), ref: 007F09C0
lstrcpyW.KERNEL32(?,008E96C0), ref: 007F09CC
ExpandEnvironmentStringsW.KERNEL32(?,?,00000138,?,?,?,?), ref: 007F09E4
lstrcpynW.KERNEL32(?,?,00000104,?,?,?,?), ref: 007F0A00
ShellExecuteExW.SHELL32(0000003C), ref: 007F0A9C
DialogBoxIndirectParamW.USER32(?,00000000,?,Function_000123D0,00000000), ref: 007F0AC6
LocalFree.KERNEL32(00000000), ref: 007F0AD1

Strings

<, xrefs: 007F0A45
<, xrefs: 007F073B

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: BuffStringlstrcpy$GlobalWindow$CreateExecuteHandleLoadMessageNamePathShellShortlstrcpynlstrlen$AllocAsyncClientConnectDialogDisconnectEnabledEnumEnvironmentExpandForegroundFreeIconicIndirectInitializeLocalLockParamPostShowStringsTransactionUninitializeUnlockWindowswsprintf
String ID: <$<
API String ID: 2206026705-213342407
Opcode ID: fa400a8a7c1b190a2662010ebafef360fa32fbbc1e031814b75f2092bfe77e92
Instruction ID: 93486d913a8c2b2c27d5eb407c5e42642067112cb32727e0dcffb03a600c21dc
Opcode Fuzzy Hash: fa400a8a7c1b190a2662010ebafef360fa32fbbc1e031814b75f2092bfe77e92
Instruction Fuzzy Hash: 74F1AFB1504348ABE720DF60DC89BAB77E8FB85704F004919F684973A1E7F9D948CB92

Uniqueness

Uniqueness Score: -1.00%

Function 007EE3D0 Relevance: 70.6, APIs: 35, Strings: 5, Instructions: 569windowCOMMON

Download Yara Rule

APIs

PathCompactPathExW.SHLWAPI(?,008EBF0C,00000050,00000000), ref: 007EE452
LoadStringW.USER32(?,?,00000100), ref: 007EE479
LoadStringW.USER32(?,?,00000100), ref: 007EE493
SendMessageW.USER32 ref: 007EE9D4
CoTaskMemFree.OLE32(?), ref: 007EE9E6
CoTaskMemFree.OLE32(?), ref: 007EE9F4

Strings

, xrefs: 007EE761
1 2 3 4 5 0 8, xrefs: 007EEBC9
*.*, xrefs: 007EE857, 007EEC00
, xrefs: 007EE9CC
%s | %s %s | %s, xrefs: 007EE7F7

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: FreeLoadPathStringTask$CompactMessageSend
String ID: $ $%s | %s %s | %s$*.*$1 2 3 4 5 0 8
API String ID: 1377716363-2071259183
Opcode ID: 1f4337950490fd957ff2cdd52bd53b02ad54f32cd52d26b2995a1921dbe68daa
Instruction ID: 2e18f0e25000aa1e48f7f68fdd5d625af957070e872b3cbc15d469b3c5e36a6f
Opcode Fuzzy Hash: 1f4337950490fd957ff2cdd52bd53b02ad54f32cd52d26b2995a1921dbe68daa
Instruction Fuzzy Hash: 4E22D0B1604385ABD720DB65DC49FAB77E8BB48304F104D29F64AD72A0E779E904CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02A4E181 Relevance: 60.4, APIs: 4, Strings: 30, Instructions: 909threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02A610D0: CoInitializeEx.OLE32(00000000,00000000,00000001,00000000), ref: 02A610D4
Part of subcall function 02A610D0: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 02A610F0

Part of subcall function 02A5FE10: GetComputerNameExW.KERNEL32(00000002,?,?,7E6776EF,?,?,?), ref: 02A5FE99

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000104), ref: 02A4E271
GetCurrentThreadId.KERNEL32 ref: 02A4E736

Strings

:, xrefs: 02A4E1AE
;, xrefs: 02A4E1CA
c:\, xrefs: 02A4ED9C
,, xrefs: 02A4ECB7
$, xrefs: 02A4ECE9
u, xrefs: 02A4ECD5
=, xrefs: 02A4E1B5
a, xrefs: 02A4ECDF
M, xrefs: 02A4E282
currentFilePath: %ls, xrefs: 02A4E348
Checking arguments, xrefs: 02A4E92A
/, xrefs: 02A4EDE7
3, xrefs: 02A4E1BC
1, xrefs: 02A4E1A0
d, xrefs: 02A4ECCB
D, xrefs: 02A4EF42
", xrefs: 02A4EDE0
+, xrefs: 02A4E1C3
{, xrefs: 02A4ECC1
., xrefs: 02A4ECF3
:, xrefs: 02A4E1A7
%, xrefs: 02A4ECFD
w, xrefs: 02A4E279
^, xrefs: 02A4E197
A, xrefs: 02A4EC83
$, xrefs: 02A4ECA1
-, xrefs: 02A4E1D1
Y, xrefs: 02A4E2AC
., xrefs: 02A4EC97
5, xrefs: 02A4ECAD

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: InitializeName$ComputerCurrentFileModuleSecurityThread
String ID: "$$$$$%$+$,$-$.$.$/$1$3$5$:$:$;$=$A$Checking arguments$D$M$Y$^$a$c:\$currentFilePath: %ls$d$u$w${
API String ID: 2120560491-2309608286
Opcode ID: 9276c4298b4801c7c0e433fe2954a1d4c3086112855aa8bfffa201dbc0b5ab83
Instruction ID: 27d48030477b65e887e88653b5120f2bd7ff4872d7f5f4e94ccc3f81e2c63b98
Opcode Fuzzy Hash: 9276c4298b4801c7c0e433fe2954a1d4c3086112855aa8bfffa201dbc0b5ab83
Instruction Fuzzy Hash: 41829E71D002188FDB28DF68DE94BEDBBB5BF88304F144599D449AB241EF70AA85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 007F0AF0 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 129windowstringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(008E9CF8,Notepad3), ref: 007F0B66
EnumWindows.USER32(Function_000201F0,?), ref: 007F0B7E
IsIconic.USER32(00000000), ref: 007F0B91
IsZoomed.USER32(00000000), ref: 007F0B9F
SendMessageW.USER32(?,00000112,0000F120,00000000), ref: 007F0BB9
SetForegroundWindow.USER32(00000000), ref: 007F0BC9
BringWindowToTop.USER32(00000000), ref: 007F0BCF
SetForegroundWindow.USER32 ref: 007F0BD6
GetSystemMetrics.USER32(00000000), ref: 007F0BDA
GetWindowRect.USER32(?,?), ref: 007F0BEE
GetWindowRect.USER32(?,?), ref: 007F0BF9
EqualRect.USER32(?,?), ref: 007F0C43
SystemParametersInfoW.USER32(00000048,00000008,?,00000000), ref: 007F0C5F
DrawAnimatedRects.USER32(?,00000003,?,?,?,?), ref: 007F0C79
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,?), ref: 007F0C90

Part of subcall function 007D33B0: lstrlenW.KERNEL32(?,?), ref: 007D3516

Strings

UseTargetApplication, xrefs: 007F0B06
TargetApplicationWndClass, xrefs: 007F0B30
Target Application, xrefs: 007F0B0B, 007F0B35
Notepad3, xrefs: 007F0B5C

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Window$Rect$ForegroundSystem$AnimatedBringDrawEnumEqualIconicInfoMessageMetricsParametersRectsSendWindowsZoomedlstrcpylstrlen
String ID: Notepad3$Target Application$TargetApplicationWndClass$UseTargetApplication
API String ID: 1367193657-1024641697
Opcode ID: 34e700a6056828b02181b9a611d6182bb080e448ea40c15ff3d9750cc376b2dd
Instruction ID: c28a18d0d116934cb0cdee36534aef3c996769b94aeddf47a5ffdb203614848c
Opcode Fuzzy Hash: 34e700a6056828b02181b9a611d6182bb080e448ea40c15ff3d9750cc376b2dd
Instruction Fuzzy Hash: 4C417AB5244301AFD7109F24DC49B6B7BE8FB88705F004929F695E6391E7B4D908CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 007ED9AB Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 124windowstringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(008E9CF8,Notepad3), ref: 007EDA0E
EnumWindows.USER32(007F01F0,?), ref: 007EDA26
IsIconic.USER32(00000000), ref: 007EDA39
IsZoomed.USER32(00000000), ref: 007EDA47
SendMessageW.USER32(?,00000112,0000F120,00000000), ref: 007EDA61
SetForegroundWindow.USER32(00000000), ref: 007EDA71
BringWindowToTop.USER32(00000000), ref: 007EDA77
SetForegroundWindow.USER32 ref: 007EDA7E
GetSystemMetrics.USER32(00000000), ref: 007EDA82
GetWindowRect.USER32(?,?), ref: 007EDA99
GetWindowRect.USER32(?,?), ref: 007EDAA4
EqualRect.USER32(?,?), ref: 007EDAFD
SystemParametersInfoW.USER32(00000048,00000008,?,00000000), ref: 007EDB1D
DrawAnimatedRects.USER32(?,00000003,?,?,?,?), ref: 007EDB3A
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,?), ref: 007EDB57

Part of subcall function 007D33B0: lstrlenW.KERNEL32(?,?), ref: 007D3516

Strings

UseTargetApplication, xrefs: 007ED9B0
TargetApplicationWndClass, xrefs: 007ED9D8
Target Application, xrefs: 007ED9B5, 007ED9DD
Notepad3, xrefs: 007EDA04

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Window$Rect$ForegroundSystem$AnimatedBringDrawEnumEqualIconicInfoMessageMetricsParametersRectsSendWindowsZoomedlstrcpylstrlen
String ID: Notepad3$Target Application$TargetApplicationWndClass$UseTargetApplication
API String ID: 1367193657-1024641697
Opcode ID: 430a134e925cd4cef1ec89da0e8b30836e7342b12a873812507a8197c36e4b72
Instruction ID: 116a237272d3eae9481c04a836c6dc6192766c7eb6452c13fcc7fb4adf9f2253
Opcode Fuzzy Hash: 430a134e925cd4cef1ec89da0e8b30836e7342b12a873812507a8197c36e4b72
Instruction Fuzzy Hash: 7E41B175248740ABE7308F65DC49B6B77E8FB88705F104829F699E72D0EB78D908CB12

Uniqueness

Uniqueness Score: -1.00%

Function 007E2F30 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 69windowstringmemoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,?,007D2773), ref: 007E2F39

Part of subcall function 007E8460: ResolveLocaleName.KERNEL32(008E8FF0,?,00000055), ref: 007E848A
Part of subcall function 007E8460: GetLocaleInfoEx.KERNEL32(?,20000001,00000002), ref: 007E84AD

FormatMessageW.KERNEL32 ref: 007E2F63
lstrlenW.KERNEL32(00000000,00000000,008E8DE8), ref: 007E2F7A
lstrlenW.KERNEL32(00000000), ref: 007E2F82
LocalAlloc.KERNEL32(00000040,00000000), ref: 007E2F92
GetFocus.USER32 ref: 007E2FBF
MessageBoxExW.USER32(?,00000000,MiniPath - ERROR,00000010,?), ref: 007E2FDA
LocalFree.KERNEL32(00000000,?,?,007D2773), ref: 007E2FE1
LocalFree.KERNEL32(?), ref: 007E2FE7

Strings

Error: '%s' failed with error id %d:%s., xrefs: 007E2FAD
MiniPath - ERROR, xrefs: 007E2FD0

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Local$FreeLocaleMessagelstrlen$AllocErrorFocusFormatInfoLastNameResolve
String ID: Error: '%s' failed with error id %d:%s.$MiniPath - ERROR
API String ID: 2054022804-1590999508
Opcode ID: dd1fe066712fd0400d73b27433bab7f676d663df0911d9ea040bf28037938388
Instruction ID: 9eca2a4aeb51cb7e6524998aa6d80a7049032d25838670c7b597756d6e8503b7
Opcode Fuzzy Hash: dd1fe066712fd0400d73b27433bab7f676d663df0911d9ea040bf28037938388
Instruction Fuzzy Hash: 0611E275644304BFE3116F61DC09F6BBBECFB89B55F050829F900E2290D679DD08CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 007E66E0 Relevance: 9.1, APIs: 6, Instructions: 75stringCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(00000000,0000000F,00000008,00000008,00000000,?,?,?,?,?,007EF240), ref: 007E670F
lstrlenW.KERNEL32(?,775A3070,75B03760,?,?,?,?,007EF240), ref: 007E672C
CharPrevW.USER32(?,00000000,?,?,?,?,007EF240), ref: 007E6733
lstrlenW.KERNEL32(00000000,?,?,?,?,007EF240), ref: 007E6749
CharPrevW.USER32(?,00000000,?,?,?,?,007EF240), ref: 007E676A
lstrlenW.KERNEL32(?,?,?,?,?,007EF240), ref: 007E6777

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: lstrlen$CharPrev$InfoLocale
String ID:
API String ID: 1002616787-0
Opcode ID: 51a246eef0c72715c11e3856c1172e1ee7080e7d05cfbf005829b5c57d4a1238
Instruction ID: fe03ae78a97c3d87af3ad48f89cd4089b736353fd6296d11223b4f7749d82ade
Opcode Fuzzy Hash: 51a246eef0c72715c11e3856c1172e1ee7080e7d05cfbf005829b5c57d4a1238
Instruction Fuzzy Hash: 7C11D6766002155BD710AF659C85A7B77DCFF99350F410829F956C3112EA39D804C3A6

Uniqueness

Uniqueness Score: -1.00%

Function 02ADC17E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(000000FF,2000000B,02ADC49C,00000002,00000000,?,?,?,02ADC49C,?,00000000), ref: 02ADC217
GetLocaleInfoW.KERNEL32(000000FF,20001004,02ADC49C,00000002,00000000,?,?,?,02ADC49C,?,00000000), ref: 02ADC240
GetACP.KERNEL32(?,?,02ADC49C,?,00000000), ref: 02ADC255

Strings

OCP, xrefs: 02ADC1D2
ACP, xrefs: 02ADC19C

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 6d91de1c96dbd6bed9f2480c1f84f34a91ca6a30679239cb574b5c417060a557
Instruction ID: f93241c9bff54c53d12c83d9801cecf732bf1b5a25d34e6e00cf25ceb4d142b3
Opcode Fuzzy Hash: 6d91de1c96dbd6bed9f2480c1f84f34a91ca6a30679239cb574b5c417060a557
Instruction Fuzzy Hash: 00219272A00110E6DB30AFA4D984B97F3A7BB54E74B968466F90BD7104FF32DA46C350

Uniqueness

Uniqueness Score: -1.00%

Function 0083C823 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0083CB41,00000002,00000000,?,?,?,0083CB41,?,00000000), ref: 0083C8BC
GetLocaleInfoW.KERNEL32(?,20001004,0083CB41,00000002,00000000,?,?,?,0083CB41,?,00000000), ref: 0083C8E5
GetACP.KERNEL32(?,?,0083CB41,?,00000000), ref: 0083C8FA

Strings

OCP, xrefs: 0083C877
ACP, xrefs: 0083C841

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 2c97fa4670701854c34a917b784d705cf7147d16f53666549fe8776fab2170ac
Instruction ID: e812eed68d71c842362fdd79f84b8b542fe78b8d9292adbd55cfa3f32169c3c1
Opcode Fuzzy Hash: 2c97fa4670701854c34a917b784d705cf7147d16f53666549fe8776fab2170ac
Instruction Fuzzy Hash: A5215936A40104AADB349F69C904AABB6A6FFD1B65F568474E90AE7210E732DF40D3D0

Uniqueness

Uniqueness Score: -1.00%

Function 02A4C4FE Relevance: 7.8, Strings: 5, Instructions: 1513COMMON

Download Yara Rule

Strings

-file, xrefs: 02A4C8D9
0, xrefs: 02A4D0F7
-threads, xrefs: 02A4C9DF
cesses, xrefs: 02A4CA7D
-nomutex, xrefs: 02A4C7DD

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID:
String ID: -file$-nomutex$-threads$0$cesses
API String ID: 0-2730867610
Opcode ID: 76518cb6505e236ceaea33473beb4f364b4b0e6a98de6ba033b183ca3a587f77
Instruction ID: d86f63e64530ada2b9a6052a7e3ebb9fe4594af0d5847a3ee1ae19306be369b4
Opcode Fuzzy Hash: 76518cb6505e236ceaea33473beb4f364b4b0e6a98de6ba033b183ca3a587f77
Instruction Fuzzy Hash: 3AE26CB1D002198FCB19CF68C994BEDBBB5FF88314F1446A9D509A7691DF30AA85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02ADC353 Relevance: 7.7, APIs: 5, Instructions: 183COMMON

Download Yara Rule

APIs

Part of subcall function 02ACF57F: GetLastError.KERNEL32(00000010,00000000,02ADB237,02B0BD50,0000000C,02AD0554,0000000C,?,02AC111D,00000000,0000000C,?,00000000,00000000,00000000), ref: 02ACF583
Part of subcall function 02ACF57F: SetLastError.KERNEL32(00000000,00000000,00000000,?,00000000,02A4FBF1,?,02A4FBF1,02A4FBF1,?,02AC5A75,F4458D02,F4458D02), ref: 02ACF625

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 02ADC45F
IsValidCodePage.KERNEL32(00000000), ref: 02ADC4A8
IsValidLocale.KERNEL32(?,00000001), ref: 02ADC4B7
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 02ADC4FF
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 02ADC51E

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: f43cd7fe9866f9d0cee6ad59686b6cb8d5797ed7c0525d58470bbea4accb6cbe
Instruction ID: 2c1918ce7b7c08dc1c3037de54fbba4e2b623fd92e222768b3250873b595f5d3
Opcode Fuzzy Hash: f43cd7fe9866f9d0cee6ad59686b6cb8d5797ed7c0525d58470bbea4accb6cbe
Instruction Fuzzy Hash: D35190B1940215ABDF10DFA5CD84ABE73BABF04714F54486AE912EB190EF70E505CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0083C9F8 Relevance: 7.7, APIs: 5, Instructions: 183COMMON

Download Yara Rule

APIs

Part of subcall function 0082F9EE: GetLastError.KERNEL32(?,00000008,00838EFD), ref: 0082F9F2
Part of subcall function 0082F9EE: SetLastError.KERNEL32(00000000,008607B0,00000024,0082E9BA), ref: 0082FA94

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0083CB04
IsValidCodePage.KERNEL32(00000000), ref: 0083CB4D
IsValidLocale.KERNEL32(?,00000001), ref: 0083CB5C
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0083CBA4
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0083CBC3

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 8bbf1dd642c4a96341173a0fc79193c4b57e9b3334fd262142f2e7dffd2fce2a
Instruction ID: 2c9f01d7626fd65762e005fb866305f6abccc1d0bc745edd27a29cb224c824ba
Opcode Fuzzy Hash: 8bbf1dd642c4a96341173a0fc79193c4b57e9b3334fd262142f2e7dffd2fce2a
Instruction Fuzzy Hash: AF519072A00219ABDB10DFA9DC42ABEB7B8FF84701F044425E900F7191E7749A44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 007E84F0 Relevance: 7.6, APIs: 5, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

GetUserPreferredUILanguages.KERNEL32(00000008,?,00000000,00000000), ref: 007E8541
LocalAlloc.KERNEL32(00000040,?), ref: 007E8559
GetUserPreferredUILanguages.KERNEL32(00000008,?,00000000,?), ref: 007E8576
LocalFree.KERNEL32(00000000), ref: 007E85C8
GetLocaleInfoEx.KERNEL32(00000000,0000005C,?,00000055), ref: 007E85E0

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: LanguagesLocalPreferredUser$AllocFreeInfoLocale
String ID:
API String ID: 1113077726-0
Opcode ID: 5f782e7dcf7f0ce3290ca558940cf89fdb3ac0869aac65c2825bc1901e570dbe
Instruction ID: b12c5ae42e6697da6c640acceab027836134c102d627ea26a50b947b063b8db4
Opcode Fuzzy Hash: 5f782e7dcf7f0ce3290ca558940cf89fdb3ac0869aac65c2825bc1901e570dbe
Instruction Fuzzy Hash: 433169712093459BE360DF15DC45B6BB7E8FB88711F40842EBA59D6281EF78D908CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 0083C076 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMON

Download Yara Rule

APIs

Part of subcall function 0082F9EE: GetLastError.KERNEL32(?,00000008,00838EFD), ref: 0082F9F2
Part of subcall function 0082F9EE: SetLastError.KERNEL32(00000000,008607B0,00000024,0082E9BA), ref: 0082FA94

GetACP.KERNEL32(?,?,?,?,?,?,0082D613,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 0083C137
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0082D613,?,?,?,00000055,?,-00000050,?,?), ref: 0083C162
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0083C2C5

Strings

utf8, xrefs: 0083C234

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: f4f1d9b1d858af8181c8e17080d69c0d62ffcaf3fc35d86ad2d3e5b77017ca4c
Instruction ID: a1324097fff5b752a78e743ea2ba7be17f6a204a1112b24e181a28e829229102
Opcode Fuzzy Hash: f4f1d9b1d858af8181c8e17080d69c0d62ffcaf3fc35d86ad2d3e5b77017ca4c
Instruction Fuzzy Hash: 8B71F771600615AADB24AB79CC46BBB73A8FFC5710F14446AFA05E7181EBB4E940C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 0083FDBC Relevance: 6.4, Strings: 4, Instructions: 1436COMMON

Download Yara Rule

Strings

1#IND, xrefs: 0083FEC1
1#SNAN, xrefs: 0083FEC8
1#QNAN, xrefs: 0083FECF
1#INF, xrefs: 0083FEF2

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 0-2761157908
Opcode ID: ba5f37226cf41c75a130ad223f293bf75746f8e632867994da2cfb85e8d0b0d1
Instruction ID: 83562e74cb3c3cafd88e9ab6c70835eea568009197e0accf34e2b9ea48df62e1
Opcode Fuzzy Hash: ba5f37226cf41c75a130ad223f293bf75746f8e632867994da2cfb85e8d0b0d1
Instruction Fuzzy Hash: 3AD21571E0822C8BDB65CE28DD447EAB7B5FB84304F1445EAD94DE7240EB78AE858F41

Uniqueness

Uniqueness Score: -1.00%

Function 00836446 Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,00000000,?,00000000), ref: 008364E1
FindNextFileW.KERNEL32(00000000,?), ref: 0083655C
FindClose.KERNEL32(00000000), ref: 0083657E
FindClose.KERNEL32(00000000), ref: 008365A1

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 6f5b4a81bef015ecf79d5ca2f1ee243ba6981ad3e2abc94954da5d233772f1a8
Instruction ID: 31c0938941800452e4b7f7f6ee980508f6d35b1045e6074fd58abb1a8c19601f
Opcode Fuzzy Hash: 6f5b4a81bef015ecf79d5ca2f1ee243ba6981ad3e2abc94954da5d233772f1a8
Instruction Fuzzy Hash: EB41D071D00629BEDF20EF6CCC88AAAB7B8FBC5314F1481A5E505D3144FA309E94CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 007E6080 Relevance: 6.1, APIs: 4, Instructions: 102stringcomCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0085378C,00000000,00000001,0084FD7C,?,0000C356,?), ref: 007E60AF
lstrcpyW.KERNEL32(?,?), ref: 007E60DB
ExpandEnvironmentStringsW.KERNEL32(?,?,00000138), ref: 007E6152
lstrcpynW.KERNEL32(?,?,?), ref: 007E616C

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: CreateEnvironmentExpandInstanceStringslstrcpylstrcpyn
String ID:
API String ID: 4041286039-0
Opcode ID: ea097cb902d5765a4291f6b03b65ef0e6309f864e0335b180067696b67636e29
Instruction ID: 84eab4a55a1a798dd11a6386b18757a7b93e511a755d324912ec2d759713b45b
Opcode Fuzzy Hash: ea097cb902d5765a4291f6b03b65ef0e6309f864e0335b180067696b67636e29
Instruction Fuzzy Hash: BE315AB1204246AFD320DF69DC84EABB7E9FFC9740F000829B619C7251EB75E805CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02AB23C5 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 02AB23D1
IsDebuggerPresent.KERNEL32 ref: 02AB249D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 02AB24BD
UnhandledExceptionFilter.KERNEL32(?), ref: 02AB24C7

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 77d22427e130182a8d7b84448565c05641ee28a14d9a3697ba773d0907222b2c
Instruction ID: 3dc7dd63e16a876e04c58948ff01a9d0fdd0055494262fce76ea46ffe0447bf7
Opcode Fuzzy Hash: 77d22427e130182a8d7b84448565c05641ee28a14d9a3697ba773d0907222b2c
Instruction Fuzzy Hash: 3B312475D41218DBDF11DFA0D989BCDBBB8BF08304F1041AAE40DAB240EB719A89CF54

Uniqueness

Uniqueness Score: -1.00%

Function 007F39B3 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 007F39BF
IsDebuggerPresent.KERNEL32 ref: 007F3A8B
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 007F3AAB
UnhandledExceptionFilter.KERNEL32(?), ref: 007F3AB5

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 5cf222bd3fa1ba31d5f992c50254e8b1face631b7da3c40d76750223f20d4ad5
Instruction ID: 365afae9b5f27eb64e56b1f9862d26a18d30093dc1cc1921ddad6de0698c9cfa
Opcode Fuzzy Hash: 5cf222bd3fa1ba31d5f992c50254e8b1face631b7da3c40d76750223f20d4ad5
Instruction Fuzzy Hash: F3312675D0122CDBDB20DFA1D989BCCBBB8BF08300F1040AAE50DAB250EB759A84CF45

Uniqueness

Uniqueness Score: -1.00%

Function 02AB25C2 Relevance: 6.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,02AB26E2,02AF193C), ref: 02AB25C7
UnhandledExceptionFilter.KERNEL32(02AB26E2,?,02AB26E2,02AF193C), ref: 02AB25D0
GetCurrentProcess.KERNEL32(C0000409,?,02AB26E2,02AF193C), ref: 02AB25DB
TerminateProcess.KERNEL32(00000000,?,02AB26E2,02AF193C), ref: 02AB25E2

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 718b1168ad361d26ab6bf9a2a6b4b3a615776ad56eec36c8b71f52ce82a31c0b
Instruction ID: a6176f0df6602eb1bfd974ae73b245b37dc8a9f419d7d93e58b43891a182f0c6
Opcode Fuzzy Hash: 718b1168ad361d26ab6bf9a2a6b4b3a615776ad56eec36c8b71f52ce82a31c0b
Instruction Fuzzy Hash: 59D0E971884209EBDF042BE1E90DA593A28BF0576AF044C54F70989461DE7294678F75

Uniqueness

Uniqueness Score: -1.00%

Function 007F3225 Relevance: 6.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,007F3345,00855570), ref: 007F322A
UnhandledExceptionFilter.KERNEL32(007F3345,?,007F3345,00855570), ref: 007F3233
GetCurrentProcess.KERNEL32(C0000409,?,007F3345,00855570), ref: 007F323E
TerminateProcess.KERNEL32(00000000,?,007F3345,00855570), ref: 007F3245

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 290ff934862011442c3244c037213b1230edf1e9b5dd40145bcbe959eab47f63
Instruction ID: b46a1e240ecbb0936a7010d644d0cb49d6ad4d5a68d6f1f54698951fd6689e18
Opcode Fuzzy Hash: 290ff934862011442c3244c037213b1230edf1e9b5dd40145bcbe959eab47f63
Instruction Fuzzy Hash: D0D0123A040229ABCB002BE0FC0DE083F2CFB0A306F008460F30A82031CBF14400CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 007F2503 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,007F2448,0000001C,007F263D,00000000,00000000,00000000,?,?,?,?,?,007F2448,00000004,008E76E4,007F2993), ref: 007F2514
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,007F2448,00000004,008E76E4,007F2993,?), ref: 007F252F

Strings

D, xrefs: 007F2523

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 1ce86e6a83f3bea7990e3b8f3b9b0a83a749efca161ff7cf7a821269b4c35a25
Instruction ID: 4479d75e1250f3e03e39680e35bc3f3c2e77df13759a0fe990e2f5a184212a17
Opcode Fuzzy Hash: 1ce86e6a83f3bea7990e3b8f3b9b0a83a749efca161ff7cf7a821269b4c35a25
Instruction Fuzzy Hash: A801F77260010DABDB14DE29DC05BED7BAABFC4324F0CC260EE19D7241E638D916C680

Uniqueness

Uniqueness Score: -1.00%

Function 007E8460 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

ResolveLocaleName.KERNEL32(008E8FF0,?,00000055), ref: 007E848A
GetLocaleInfoEx.KERNEL32(?,20000001,00000002), ref: 007E84AD

Strings

en-US, xrefs: 007E8474, 007E8485

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Locale$InfoNameResolve
String ID: en-US
API String ID: 2669342117-1228076028
Opcode ID: dcc57f0bea387943cd13546e9fc3854629366306bdf9a3f1e8eea5b319c8c0bf
Instruction ID: 3fc505728824c6402c80c5329ffa5a7d77aa0be5ae143888ca2ca3d5dabe47dc
Opcode Fuzzy Hash: dcc57f0bea387943cd13546e9fc3854629366306bdf9a3f1e8eea5b319c8c0bf
Instruction Fuzzy Hash: 2BF0AF742043819AE360DF20DC4AB7B33E4FB88700F804818BA59C32D1EB789944DB47

Uniqueness

Uniqueness Score: -1.00%

Function 0083C4A7 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0082F9EE: GetLastError.KERNEL32(?,00000008,00838EFD), ref: 0082F9F2
Part of subcall function 0082F9EE: SetLastError.KERNEL32(00000000,008607B0,00000024,0082E9BA), ref: 0082FA94

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0083C4FB
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0083C545
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0083C60B

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: fdddf77ef2e0f5b6c096d3d2bb5aad17a34fbd0bc2eaba7cf56caba115e74a5f
Instruction ID: 2e2b27e8b1fc480b408b01e55c25da4391fe415d0f332eb65d6600e4fc40ffa6
Opcode Fuzzy Hash: fdddf77ef2e0f5b6c096d3d2bb5aad17a34fbd0bc2eaba7cf56caba115e74a5f
Instruction Fuzzy Hash: 8961C47194020B9FDB289F28CC86BBA77A8FF54301F10417AE905E6295FB74E985DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00820E7D Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00820F75
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00820F7F
UnhandledExceptionFilter.KERNEL32(-00000227,?,?,?,?,?,00000000), ref: 00820F8C

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 2602fc28bdd1ddaab9926b3da97620db686d9a98defefd7ac9cb5c8ddc583898
Instruction ID: 9b5e5e543ebb72f34791668bd8ae40e742667db972b535a6acd7cf9f2da6f7af
Opcode Fuzzy Hash: 2602fc28bdd1ddaab9926b3da97620db686d9a98defefd7ac9cb5c8ddc583898
Instruction Fuzzy Hash: 1F31D57490122C9BCB21DF64D98879DBBB8BF08310F5041EAE91CA7291E7749B858F44

Uniqueness

Uniqueness Score: -1.00%

Function 007F114B Relevance: 3.0, APIs: 2, Instructions: 38COMMON

Download Yara Rule

APIs

LCIDToLocaleName.KERNEL32(?,?,00000055,08000000), ref: 007F116B
GetLocaleInfoEx.KERNEL32(?,0000006D,00000000,00000055), ref: 007F117D

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Locale$InfoName
String ID:
API String ID: 3347482803-0
Opcode ID: 2c9e0031d8ddfee92356bed099787503d751ae5c8360df308cf25804bc8df779
Instruction ID: d796e8c5e9a9499fe0fefe31c1a32c28f026177aa7f720bbe3f8e4eae6de2635
Opcode Fuzzy Hash: 2c9e0031d8ddfee92356bed099787503d751ae5c8360df308cf25804bc8df779
Instruction Fuzzy Hash: C2F09A3174131DFBEB205F258C09BBB3B9EFF05B52F840812BB15DA290D6B8C810DAA0

Uniqueness

Uniqueness Score: -1.00%

Function 007F7DE3 Relevance: 2.4, Strings: 1, Instructions: 1103COMMON

Download Yara Rule

Strings

/, xrefs: 007F86C6

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 771500efa1c9f2b442e3d84250db48a6f5052c2451ea35a31e46ada0b777f8ff
Instruction ID: 05e7cfaaf58a8e52029c80042029776822aed5c7d807b5581c89e145de9aa7f2
Opcode Fuzzy Hash: 771500efa1c9f2b442e3d84250db48a6f5052c2451ea35a31e46ada0b777f8ff
Instruction Fuzzy Hash: 03824A71D1421DDADF58DBA8C895AFEB7B8BF48300F14452AEA11E7380EF789A44CB51

Uniqueness

Uniqueness Score: -1.00%

Function 007F9931 Relevance: 1.9, Strings: 1, Instructions: 661COMMON

Download Yara Rule

Strings

&& , xrefs: 007F9EEA

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID: &&
API String ID: 0-993083564
Opcode ID: 7b7e12690a3dca31c7b5ce873a20b97d8b9a875d80c09f6cc012512d52459e89
Instruction ID: 8d384e173a365f904311f7d7df2804a73af2d17180caa2cea6bc5655c0628a27
Opcode Fuzzy Hash: 7b7e12690a3dca31c7b5ce873a20b97d8b9a875d80c09f6cc012512d52459e89
Instruction Fuzzy Hash: 2C423FB1D0420DEFDB19DF98D495AFEBBB4AF48300F108069E716A7391EB389A44CB51

Uniqueness

Uniqueness Score: -1.00%

Function 008485C0 Relevance: 1.8, APIs: 1, Instructions: 274COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,008485BB,?,?,00000008,?,?,008480B0,00000000), ref: 008487ED

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 4255ab5898ed6947c42b0397ef1dcc4e2e6fa4bd67dfafeefdb587de4d82e5f2
Instruction ID: bd0cbd04b6b6eb6bea923a6d2193212b126ac52186c443b3fcb26c69ae177a8b
Opcode Fuzzy Hash: 4255ab5898ed6947c42b0397ef1dcc4e2e6fa4bd67dfafeefdb587de4d82e5f2
Instruction Fuzzy Hash: B5B15C3561060DCFD719CF28C49AB697BE0FF45364F658668E899CF2A1CB35E982CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0083605C Relevance: 1.7, APIs: 1, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 461d186d60d1a2dfc83278ac08a440295ba24260cab30c418ba930715e1dc05c
Instruction ID: 89804f10faca9620c699c2e8d8948b506ea3f533fc4e2d18d8b0390350c3daa2
Opcode Fuzzy Hash: 461d186d60d1a2dfc83278ac08a440295ba24260cab30c418ba930715e1dc05c
Instruction Fuzzy Hash: 1851C575804219AFDF24DF6DCC89AAAB7B9FF85304F14829DF419D3201E6319E558F90

Uniqueness

Uniqueness Score: -1.00%

Function 02AD8178 Relevance: 1.7, APIs: 1, Instructions: 156timeCOMMON

Download Yara Rule

APIs

Part of subcall function 02ACF8C7: HeapFree.KERNEL32(00000000,00000000,?,02ADA9D3,?,00000000,?,?,02ADAC74,?,00000007,?,?,02ADB16D,?,?), ref: 02ACF8DD
Part of subcall function 02ACF8C7: GetLastError.KERNEL32(?,?,02ADA9D3,?,00000000,?,?,02ADAC74,?,00000007,?,?,02ADB16D,?,?), ref: 02ACF8E8

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,02AD832B,00000000,00000000,00000000), ref: 02AD81EA

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3335090040-0
Opcode ID: 17579621adfa21774c154f11a1247ecaa1e65941094a263c6fd0e2de075a93fc
Instruction ID: c88b9ddbb55fca8bfcfff4aacf799dab8bdb3d395292c818a852c39edd0898d4
Opcode Fuzzy Hash: 17579621adfa21774c154f11a1247ecaa1e65941094a263c6fd0e2de075a93fc
Instruction Fuzzy Hash: 2C410672C40224AFDB14AF79DE44A9EBB7AFF05760B5045AAE415E7190EF349E01CF90

Uniqueness

Uniqueness Score: -1.00%

Function 007F3BB6 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 007F3BCC

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: d5d15d6a5f73507a5e5cffbd1998b156f113379ae4f216de7fbff1413f782fb8
Instruction ID: a459046a9e60513a9e5935ba6981cc5642974bb36408a6ad5074b1de9f53530d
Opcode Fuzzy Hash: d5d15d6a5f73507a5e5cffbd1998b156f113379ae4f216de7fbff1413f782fb8
Instruction Fuzzy Hash: 62519EB1A04659CBDB25CF95D8857AEB7F0FB48310F14852AD516EB390D3B89B40CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0081A5A5 Relevance: 1.6, Strings: 1, Instructions: 392COMMON

Download Yara Rule

Strings

0, xrefs: 0081A749

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 672b2bd2699daa9b119663069a4613dbb66184913c317cb8e23c9028e64d4698
Instruction ID: a2b84c85c39a73ffecb6a3888e90d012ed1f509a1515a3baae6e99b00e51ac1f
Opcode Fuzzy Hash: 672b2bd2699daa9b119663069a4613dbb66184913c317cb8e23c9028e64d4698
Instruction Fuzzy Hash: D6E18B746026098FCB28CF68C580AEEB7B9FF55314F244A59D496DB291D730EDC2CB52

Uniqueness

Uniqueness Score: -1.00%

Function 02AD8642 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c7538201d9ecf22b4329bee8b427d216a2d94b3110c228fb420cd232f5fc1d9
Instruction ID: 7ced55fa411f384e19fcee08785b67c313ed2657fc70d2959329e2a8b160383f
Opcode Fuzzy Hash: 5c7538201d9ecf22b4329bee8b427d216a2d94b3110c228fb420cd232f5fc1d9
Instruction Fuzzy Hash: F341C2B5C44219AFCB20DF69CD88AAABBB9EF44300F1442D9E41DE3200DB359A858F50

Uniqueness

Uniqueness Score: -1.00%

Function 0081A184 Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

0, xrefs: 0081A319

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: c937623e7cab7e898adee6cbbfb1bb3832c32730ec9bb822fd0be7832919e37d
Instruction ID: 951f289d8d12b7ce4e7731399faf0999b179bc2fcdb6e2d1b0de01a99884e774
Opcode Fuzzy Hash: c937623e7cab7e898adee6cbbfb1bb3832c32730ec9bb822fd0be7832919e37d
Instruction Fuzzy Hash: D0E1BB706027058FCB29CF68C480AFAB7BAFF49314F24465AD45ADB291D731ADC6CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0081A9D5 Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

0, xrefs: 0081AB6A

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8c1e2c704aa55512b185a14e9814b1d2f2561323949c2b2b3e229bccf0760d92
Instruction ID: 303a354fe137b3ed73c984abab4ac952436804053e7040b5d5f0fd577b62e924
Opcode Fuzzy Hash: 8c1e2c704aa55512b185a14e9814b1d2f2561323949c2b2b3e229bccf0760d92
Instruction Fuzzy Hash: D7E1BC74602A098FCB28CF68C580AEAB7FAFF45314F244659D456DB290D331ADC6CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0081901B Relevance: 1.6, Strings: 1, Instructions: 348COMMON

Download Yara Rule

Strings

0, xrefs: 008191B8

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 289800297379934a72b27b950e4c6b1b98766885bdc7f1c4077dbf2c142a356b
Instruction ID: 35f542954a8666b726454946688ba22b04cced4562bf3e7d6a89139c73df32e9
Opcode Fuzzy Hash: 289800297379934a72b27b950e4c6b1b98766885bdc7f1c4077dbf2c142a356b
Instruction Fuzzy Hash: B9C1EE30900A4A9FCB28CE68C8A4AEEB7A9FF49314F144619D4E7D7391C331ACC5CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02AC020C Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

0, xrefs: 02AC039A

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 6fd828ad99f594ebf7933c7d2d280ff1f725b62b5d565490c9f7310ea50eefd7
Instruction ID: 7de7fa8e5702c1fc20286bb8c41dbef767742364b84c4d1458dfb16f1a602aa3
Opcode Fuzzy Hash: 6fd828ad99f594ebf7933c7d2d280ff1f725b62b5d565490c9f7310ea50eefd7
Instruction Fuzzy Hash: 60C1AA74A0464ACFCB28CF68C5D06BEBBB2BB05318F24865DD5969B391CF30A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00818C8D Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

0, xrefs: 00818E1B

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 71de825c8466e9dc512c0e81d5c5216ac77ca557a24b37b668455b3a57595e0d
Instruction ID: d5b9f9250df1a74615a4ca918316b53f6b95ea0a238d1a81f74e1b053b4ce9dc
Opcode Fuzzy Hash: 71de825c8466e9dc512c0e81d5c5216ac77ca557a24b37b668455b3a57595e0d
Instruction Fuzzy Hash: 80C19E7090070ACFCB24CE28C496AEEBBBAFF55314F244659E456D7291CB31ADC6CB91

Uniqueness

Uniqueness Score: -1.00%

Function 008193B8 Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

0, xrefs: 00819546

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 2f5228e772cc88cfa96a7b1f02a8dc40c5138085437880b5afa8d5833bb3888a
Instruction ID: 1c1e26a113bf867ae047770db6cf6bd6674f40be298e4bc2ee90b95c124ea3e7
Opcode Fuzzy Hash: 2f5228e772cc88cfa96a7b1f02a8dc40c5138085437880b5afa8d5833bb3888a
Instruction Fuzzy Hash: F3C1AF7090060A8FCB29CF68C4A06FEBBAAFF55314F144629D4DAD7291D730ADC6CB55

Uniqueness

Uniqueness Score: -1.00%

Function 02ADC055 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 02ACF57F: GetLastError.KERNEL32(00000010,00000000,02ADB237,02B0BD50,0000000C,02AD0554,0000000C,?,02AC111D,00000000,0000000C,?,00000000,00000000,00000000), ref: 02ACF583
Part of subcall function 02ACF57F: SetLastError.KERNEL32(00000000,00000000,00000000,?,00000000,02A4FBF1,?,02A4FBF1,02A4FBF1,?,02AC5A75,F4458D02,F4458D02), ref: 02ACF625

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 02ADC0A9

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 65c5e3b5fd53a3de0968ac3b7a6b8c0c9bd4e0bdef9450f9a1c99273f58cd76f
Instruction ID: 7a6eb8818f56303110fa15870fb3d667a98e7838ab1e248cc2accb5bce122d31
Opcode Fuzzy Hash: 65c5e3b5fd53a3de0968ac3b7a6b8c0c9bd4e0bdef9450f9a1c99273f58cd76f
Instruction Fuzzy Hash: AF217F72A90216ABEB289B25DD82BBA77AAEF44324F50007BF906D6140EF35D945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0083C6FA Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0082F9EE: GetLastError.KERNEL32(?,00000008,00838EFD), ref: 0082F9F2
Part of subcall function 0082F9EE: SetLastError.KERNEL32(00000000,008607B0,00000024,0082E9BA), ref: 0082FA94

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0083C74E

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 5a90591b9198b4e3015f1a8a58ce17ff14b3e0f07bad208c1d8fff5e30d3b30e
Instruction ID: b789892e6612b88f43b40fc48b6aefa9befb8aeb049682c6a9498b35e4a8d3dc
Opcode Fuzzy Hash: 5a90591b9198b4e3015f1a8a58ce17ff14b3e0f07bad208c1d8fff5e30d3b30e
Instruction Fuzzy Hash: D121837251110AABDB18AE29DC42E7A77ACFF85714F10007AFD01E6241EB749D45DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00819AAB Relevance: 1.6, Strings: 1, Instructions: 326COMMON

Download Yara Rule

Strings

0, xrefs: 00819C52

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: c466f45c1d5f40109abd4787cea0672c6b9b138119a0b4053d5aab153678d765
Instruction ID: bc5a362dfff6767fa4a74d0a3375bf0dc869d440aa95ec998ff23ce536de2cf3
Opcode Fuzzy Hash: c466f45c1d5f40109abd4787cea0672c6b9b138119a0b4053d5aab153678d765
Instruction Fuzzy Hash: E7B1AE70A0461A8ACB24DF68D5A06FEB7F9FF84324F14491DD4D6E7290D630ADC6CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02AC059A Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

0, xrefs: 02AC0732

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 32476cf8c76bdf4a989d4e7c4163ee685a264cb4eec945d644894569cb9bdefb
Instruction ID: 1905fbb5cbbc9b3ec1d2f271827c7838526ac27707872010da874a16414ad4a4
Opcode Fuzzy Hash: 32476cf8c76bdf4a989d4e7c4163ee685a264cb4eec945d644894569cb9bdefb
Instruction Fuzzy Hash: 1FB1C174A4071ACBCB28DF68C590ABEB7F2AF84708F30852DD456A7650DF70A946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00819746 Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

0, xrefs: 008198DE

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: f240a4f50fbeddd2a8a4392ee8f0230deba530e024ee5e2a1c92503a8a1a74de
Instruction ID: d66698f77b9cb1b6b0799c16bbcd6df541f8d91a37f595819bfefefe9f3c1908
Opcode Fuzzy Hash: f240a4f50fbeddd2a8a4392ee8f0230deba530e024ee5e2a1c92503a8a1a74de
Instruction Fuzzy Hash: 28B1BD70A1060A8BCB24DF68C5A0AFEB7F9FF85314F14492DD496E7290D631A9C6CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00819E1F Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

0, xrefs: 00819FB7

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 400921d7d7e1aa8eff8ffedfbed3ec14383190ae864b7545c70e819c37b06685
Instruction ID: d9cc764a6578cfb36a7665ae03e7e1642c3f91261cca237056ebdbc9b5d9c8f4
Opcode Fuzzy Hash: 400921d7d7e1aa8eff8ffedfbed3ec14383190ae864b7545c70e819c37b06685
Instruction Fuzzy Hash: BBB1C270A0060A9ACB28DFA8C5A1AFEB7F9FF44314F10491DD496E7250D771ADC6CB52

Uniqueness

Uniqueness Score: -1.00%

Function 008185EE Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 00818787

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 07e152b0379f6407824c99aeb39b354d90b2f786f076583e606178a776af2264
Instruction ID: 0d3aa988581b7bb41735b38d3f2e49d8a4266b84b5fce2bd55ba02fea235cc05
Opcode Fuzzy Hash: 07e152b0379f6407824c99aeb39b354d90b2f786f076583e606178a776af2264
Instruction Fuzzy Hash: 16B1B37090064ACBCB24CF68C99A6FEBBA9FF14314F240A29D456D7291DF349DC1CB52

Uniqueness

Uniqueness Score: -1.00%

Function 008182A6 Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

0, xrefs: 00818430

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 38a7de5376f4b3d24e0b0ce6c951c522096168efe9394883ce8a273dce5a76ee
Instruction ID: 103534cb3f5e799b2bdc9597711cfed167c43af00151f3466b4483b77703e7c3
Opcode Fuzzy Hash: 38a7de5376f4b3d24e0b0ce6c951c522096168efe9394883ce8a273dce5a76ee
Instruction Fuzzy Hash: 7DB1917090060ACBCB24CF68C5966FEB7A9FF45714F18461AD862E7391DF30A9C1CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00818945 Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

0, xrefs: 00818ACF

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: c2014c31483babb46608160de4517edc9ba96a745321491e101434a46cb5ea96
Instruction ID: 478f039c9660c14af35c85422e49adba8a5722fea4faf2c1bb7bef618e4255dd
Opcode Fuzzy Hash: c2014c31483babb46608160de4517edc9ba96a745321491e101434a46cb5ea96
Instruction Fuzzy Hash: 24B1A2B090461ACBCB24CF68C496AFEBBA9FF05314F140A1AD552D7291DF3599C1CB93

Uniqueness

Uniqueness Score: -1.00%

Function 0083C381 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0082F9EE: GetLastError.KERNEL32(?,00000008,00838EFD), ref: 0082F9F2
Part of subcall function 0082F9EE: SetLastError.KERNEL32(00000000,008607B0,00000024,0082E9BA), ref: 0082FA94

EnumSystemLocalesW.KERNEL32(0083C4A7,00000001,00000000,?,-00000050,?,0083CAD8,00000000,?,?,?,00000055,?), ref: 0083C3F3

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 06be81afe22f25cb12c241c84166ed52d268af944b2a7669f999f89eb91f698d
Instruction ID: 784cba0ff9cd7415f58f3efa2f7b97baafd9e204f036c6590e46a145725b8bda
Opcode Fuzzy Hash: 06be81afe22f25cb12c241c84166ed52d268af944b2a7669f999f89eb91f698d
Instruction Fuzzy Hash: 1211C63A2007055FDB189F3988A16BABB92FBC4359B15842DE586D7B40D7716942C780

Uniqueness

Uniqueness Score: -1.00%

Function 02ADC284 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 02ACF57F: GetLastError.KERNEL32(00000010,00000000,02ADB237,02B0BD50,0000000C,02AD0554,0000000C,?,02AC111D,00000000,0000000C,?,00000000,00000000,00000000), ref: 02ACF583
Part of subcall function 02ACF57F: SetLastError.KERNEL32(00000000,00000000,00000000,?,00000000,02A4FBF1,?,02A4FBF1,02A4FBF1,?,02AC5A75,F4458D02,F4458D02), ref: 02ACF625

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,02ADC01E,00000000,00000000,?), ref: 02ADC2B0

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: d6969659bc0106018bb869bf38a23061b3681a21c335c84c5f45decfd9178cfc
Instruction ID: f5a077c9d42a850e2167793c25928bcb4c6a0d9f8c7afdb25bb6c41b148be488
Opcode Fuzzy Hash: d6969659bc0106018bb869bf38a23061b3681a21c335c84c5f45decfd9178cfc
Instruction Fuzzy Hash: 35F0FE36500211ABDF2467A089457BAB75DEB40B7CF550426DC03F3540DF70F901C594

Uniqueness

Uniqueness Score: -1.00%

Function 0083C929 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 0082F9EE: GetLastError.KERNEL32(?,00000008,00838EFD), ref: 0082F9F2
Part of subcall function 0082F9EE: SetLastError.KERNEL32(00000000,008607B0,00000024,0082E9BA), ref: 0082FA94

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0083C6C3,00000000,00000000,?), ref: 0083C955

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: fc0dec51225eb1b6f96483f90bc0c0183b2259a66db0832029421d71d1fdfefb
Instruction ID: 3add41079beaa8a0fc73599b85f881ef53143796083e4b86e2291e30dee3f6bc
Opcode Fuzzy Hash: fc0dec51225eb1b6f96483f90bc0c0183b2259a66db0832029421d71d1fdfefb
Instruction Fuzzy Hash: 16F0A436610215BBDB28AA75CC06BBA7BA8FB80754F164429ED46F3180EA75FE41C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 0083C41C Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 0082F9EE: GetLastError.KERNEL32(?,00000008,00838EFD), ref: 0082F9F2
Part of subcall function 0082F9EE: SetLastError.KERNEL32(00000000,008607B0,00000024,0082E9BA), ref: 0082FA94

EnumSystemLocalesW.KERNEL32(0083C6FA,00000001,00000000,?,-00000050,?,0083CA9C,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0083C466

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: b0b7e393600c40e5d2cdbfab56e74a9c16f5ca138b1731433010edd35a9f998b
Instruction ID: 8c9f6c12f952e24a90f88a8f9e870228e58f9929f47730f84436b1b442669964
Opcode Fuzzy Hash: b0b7e393600c40e5d2cdbfab56e74a9c16f5ca138b1731433010edd35a9f998b
Instruction Fuzzy Hash: 0EF046362003045FCB246F389CA1A7A7B95FFC1768F05842CFA42DB690D6B19C42C784

Uniqueness

Uniqueness Score: -1.00%

Function 007F0EC9 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000404,00000008,?,00000020), ref: 007F0EEE

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: c090d0d6affd9eef3240459e73b8d1351ed038b218a1a0b7e8a9ed13c408fe10
Instruction ID: fcf6e6832a6e852f5791135cef92bceb612e7a1765c802e802bf20fe4fb6c2b3
Opcode Fuzzy Hash: c090d0d6affd9eef3240459e73b8d1351ed038b218a1a0b7e8a9ed13c408fe10
Instruction Fuzzy Hash: 32F082B6A8021D67EB10DB749C06FAA77E8BB10710F440160BA05E73C1EA74EA09C655

Uniqueness

Uniqueness Score: -1.00%

Function 00832B14 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 00835ACF: EnterCriticalSection.KERNEL32(?,?,0082A8FA,00000000,00860380,0000000C,0082A8C1,?,?,00832AD7,?,?,0082FB8C,00000001,00000364,?), ref: 00835ADE

EnumSystemLocalesW.KERNEL32(00832B01,00000001,008606B0,0000000C,00833443,00000000), ref: 00832B4C

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 6376ccbaed7f1489bbc4ffff9fce187f3be1720c000bc241e365db1910844c53
Instruction ID: 698610a31151fe4541ff48f92bd8f4cb6f3387ad319c9b8f50dd37fae9ab2e47
Opcode Fuzzy Hash: 6376ccbaed7f1489bbc4ffff9fce187f3be1720c000bc241e365db1910844c53
Instruction Fuzzy Hash: A1F0C476A00214EFDB04DF98E842B9DBBA0FB88721F10812AE415DB2A1CBB959048B81

Uniqueness

Uniqueness Score: -1.00%

Function 0083C318 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 0082F9EE: GetLastError.KERNEL32(?,00000008,00838EFD), ref: 0082F9F2
Part of subcall function 0082F9EE: SetLastError.KERNEL32(00000000,008607B0,00000024,0082E9BA), ref: 0082FA94

EnumSystemLocalesW.KERNEL32(0083C271,00000001,00000000,?,?,0083CAFA,-00000050,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 0083C34F

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 4c35a38eeda8bbfc5dc7942bc1960b38f2d4ec0da3394d8c041f928c6c5c14e9
Instruction ID: 8954a2368afb87d2aab21bdb22b845aa2eb3e635efb371087845e1105172b544
Opcode Fuzzy Hash: 4c35a38eeda8bbfc5dc7942bc1960b38f2d4ec0da3394d8c041f928c6c5c14e9
Instruction Fuzzy Hash: 54F0E53A30020557CB14AF79DC46A6ABF95FFC2750F4A4069EA09DB251C6759882C790

Uniqueness

Uniqueness Score: -1.00%

Function 008335D2 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0082E403,?,20001004,00000000,00000002,?,?,0082D77B), ref: 00833606

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8341ba7bc9f33d372e24deea66e8b38bd8adc2f344b6bf4b9974f554bd2abf1e
Instruction ID: 6daaede31dc8b6fa8872d4c2befd69d935c1777a064d8fd66da04f7dfff51c23
Opcode Fuzzy Hash: 8341ba7bc9f33d372e24deea66e8b38bd8adc2f344b6bf4b9974f554bd2abf1e
Instruction Fuzzy Hash: F0E04F75504268BBCF122FA4DC06E9E7F19FF95761F004421FD05A5261CB358A21EAD5

Uniqueness

Uniqueness Score: -1.00%

Function 02AEA750 Relevance: 1.5, APIs: 1, Instructions: 17encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(?,00000000), ref: 02AEA764

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: ebd3502ce4178c60b6b8c1834647292876002783f55613c42d778eaab306f027
Instruction ID: ebc15ffb9541786240aa30f0d2941e9d245e6ed9980f64795edb069f592924cd
Opcode Fuzzy Hash: ebd3502ce4178c60b6b8c1834647292876002783f55613c42d778eaab306f027
Instruction Fuzzy Hash: 07D05E71D91220D7DA309F24BC99B4972A86F00B65F140C04AA09EB180DF60EA569BE4

Uniqueness

Uniqueness Score: -1.00%

Function 00832CA5 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(Function_00062B01,00000001), ref: 00832CBF

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 2facb7e9c15016fd4fbaa11245a0aafd0027cdeab8fd680184f916e0df0a5631
Instruction ID: 1c6863924befd2e493e632a3398d960a881c665fe772c24abf7faf6172b5d685
Opcode Fuzzy Hash: 2facb7e9c15016fd4fbaa11245a0aafd0027cdeab8fd680184f916e0df0a5631
Instruction Fuzzy Hash: 46D09235544348FBDB045F55EC8A9187B69F784B20F204419F8084B2A0DBB26844CA81

Uniqueness

Uniqueness Score: -1.00%

Function 007F132D Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

Part of subcall function 007F1311: FindResourceExW.KERNEL32(00000000,MUI,00000001,00000000,?,007F133C,00000000,00000000,?,007F144E,00000000,?,?,?,007F1515,?), ref: 007F1323

LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,007F144E,00000000,?,?,?,007F1515,?,00000000,00000000,00000000), ref: 007F1344

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Resource$FindLoad
String ID:
API String ID: 2619053042-0
Opcode ID: 9ecda7deed556432af2384aa59ff0fe98eb4bab152e479a23e7bbf30f7655d11
Instruction ID: 7c0030dfdcce6a8bdc793fe2503647e532c9ba8654bc09a058a856081ec48961
Opcode Fuzzy Hash: 9ecda7deed556432af2384aa59ff0fe98eb4bab152e479a23e7bbf30f7655d11
Instruction Fuzzy Hash: 38C0123104020CFBDB102A62DC09FAABE5DEF913A1F508020BA0A94661CB32D821E6A4

Uniqueness

Uniqueness Score: -1.00%

Function 00832C73 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(Function_00062B01,00000001), ref: 00832C89

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 65f551038351c9fb52b0630ae2e490cadd2092e7bbf5c83ae533992c0ed95005
Instruction ID: fb95f9e72da34c1c0bb3424ccdf31a657893f4f73280858aa4de726274634497
Opcode Fuzzy Hash: 65f551038351c9fb52b0630ae2e490cadd2092e7bbf5c83ae533992c0ed95005
Instruction Fuzzy Hash: 01D01274600300EFCB089F24EC8AD087B61FB89B20F200469F8068F3B0CFB22848CB81

Uniqueness

Uniqueness Score: -1.00%

Function 007F3B49 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00023B58,007F35EF), ref: 007F3B4E

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ca70966db4ef2128e7923462b2488ab18826b6fe60d81199cdc663711ff8faf4
Instruction ID: 04c06e7e77ca9337fc4ca5c21f5a1e9e312e646ccd243889fff5ffb1e351ae2f
Opcode Fuzzy Hash: ca70966db4ef2128e7923462b2488ab18826b6fe60d81199cdc663711ff8faf4
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 02A9A610 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

vg~, xrefs: 02A9A61D, 02A9A626

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID:
String ID: vg~
API String ID: 0-3861034191
Opcode ID: bba20ca01ffa746374a7f5e73811fff8e9af44d44dc95291951ae7515e81d934
Instruction ID: df87cfe7189824c8c7964bad793d0c504901eb1b2a62d1118c23d95b28d0175e
Opcode Fuzzy Hash: bba20ca01ffa746374a7f5e73811fff8e9af44d44dc95291951ae7515e81d934
Instruction Fuzzy Hash: BB4125B1A04B018FD769CF28D492A56B7F4FF99300B548A2EE49AD7A01EB30F544CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00833611 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00833617, 00833621

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID: GetSystemTimePreciseAsFileTime
API String ID: 0-595813830
Opcode ID: 936f095a1815392be3cf093d2da51c17f1e8b0e5a8e977bc0ea90401a284a3b6
Instruction ID: 2c4b3a87de9b4035e076597538210bb0d19b0477952b49090405beaca048355f
Opcode Fuzzy Hash: 936f095a1815392be3cf093d2da51c17f1e8b0e5a8e977bc0ea90401a284a3b6
Instruction Fuzzy Hash: 07E0C232AC1228B7C21136846C06DD9BA04F7F1BB3F064121FE28E6381D5A90D12C2D9

Uniqueness

Uniqueness Score: -1.00%

Function 0083897F Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0083897F

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: b720d84f21c99035cb5648168f06730f51766787c319fab1ba8009e44b2de305
Instruction ID: bbcbc004ce97c29fcef4d729a8326a372a01f6834a739b49d78c6c17fc1f3455
Opcode Fuzzy Hash: b720d84f21c99035cb5648168f06730f51766787c319fab1ba8009e44b2de305
Instruction Fuzzy Hash: F8A011B0A02282CB83808F30AB0822C3AECBA8A2803000028A008C8020EB2880008A02

Uniqueness

Uniqueness Score: -1.00%

Function 02AD6219 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c88ce02be2b02f5f8032d56f55ff0e2ca9f674767fdb76496cb51a02a6e451b0
Instruction ID: 6032193476ebcddf58cecd9bd51a531f3ed51a22851a11dbf3a6aa8b97628425
Opcode Fuzzy Hash: c88ce02be2b02f5f8032d56f55ff0e2ca9f674767fdb76496cb51a02a6e451b0
Instruction Fuzzy Hash: 81323431D69F014DD7679634D862336A35CAFB77C9F15DB27E81AB5A9AEF28C0838100

Uniqueness

Uniqueness Score: -1.00%

Function 02A826E0 Relevance: .6, Instructions: 558COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b38d4d0d025f41e3a3f575c5e5feb3c5581dda69820d2ca4b3866d60bc114e7
Instruction ID: 8a5175700a4ac2be17dce4661963023d295e092d2391c8caa37eb143444e5193
Opcode Fuzzy Hash: 0b38d4d0d025f41e3a3f575c5e5feb3c5581dda69820d2ca4b3866d60bc114e7
Instruction Fuzzy Hash: 8F3268B6500649DFCB18DF68CA94AEABBB5BF58304F05821EEC5697750DB30E909CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0080107A Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b09cba6508df9c0b0a7bb4740334416adf5c40b5209c7921746932665676e578
Instruction ID: 4624ac3c3b124ddae04442678600e00f71c50dc4c45aa34a3537659ba55ccf86
Opcode Fuzzy Hash: b09cba6508df9c0b0a7bb4740334416adf5c40b5209c7921746932665676e578
Instruction Fuzzy Hash: 31125D71A002299FDF69CF18CC84BAAB7B9FF45314F4441EAD949EB284E7709E818F51

Uniqueness

Uniqueness Score: -1.00%

Function 02A88030 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e39769683ac4c2bac853756c0a8fc3c4809edd5943801b96ce48ccc28ebae936
Instruction ID: 20ad1051d295aa496740474e2e04e868bc973906767131e089177b1c6046597d
Opcode Fuzzy Hash: e39769683ac4c2bac853756c0a8fc3c4809edd5943801b96ce48ccc28ebae936
Instruction Fuzzy Hash: 8E02B97091028D9FDF24EF64C984BEEBBE6BF04308F54425AE94597281DF78DA48CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00803BD0 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e403865b37332d6e4d28a3e02ac7cefa5516ed0a8134db23adcc442601ab295d
Instruction ID: fb80e3545d3e514c0e73892df3e38e934ea1c880d886e813035228964585f056
Opcode Fuzzy Hash: e403865b37332d6e4d28a3e02ac7cefa5516ed0a8134db23adcc442601ab295d
Instruction Fuzzy Hash: DDF13E71E0021A9FDF54CF69D8806AEB7B5FF88324F158269E915EB390D730AE41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02A90450 Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 895b601f53291facd10029cbf2d282463043c8118518966be5d6497ece3481fb
Instruction ID: 28b57fe1b58f0d3b5fc24c0433790239c081591c4ff0e6484392f335d1d800ee
Opcode Fuzzy Hash: 895b601f53291facd10029cbf2d282463043c8118518966be5d6497ece3481fb
Instruction Fuzzy Hash: 36027625D28BC88AD707D6398113296F3A4AFFB2C8F05DB1BB98435526FF60B5D79600

Uniqueness

Uniqueness Score: -1.00%

Function 02A6A190 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a332043dbf53764a755d1200a34039872a02b20953c8f546ede510d8eb2db8dc
Instruction ID: 28997d91baca2cb66614651746b735062020ffdaf779d8759a9488f018020099
Opcode Fuzzy Hash: a332043dbf53764a755d1200a34039872a02b20953c8f546ede510d8eb2db8dc
Instruction Fuzzy Hash: C2E1C076A043028FCB20CF28D88876AB7E6FFC5314F194A2DE945E3251DB31E945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00804590 Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c222ad8a5f8239c2a0fff21d30a642f4f0b206a95ce14e03a09d965013c23a42
Instruction ID: c1b65cce0764bddff3175eee3b962c9f94f13f41b4c8488257e2b8f7c7accc2a
Opcode Fuzzy Hash: c222ad8a5f8239c2a0fff21d30a642f4f0b206a95ce14e03a09d965013c23a42
Instruction Fuzzy Hash: 96E163B1A402289FDB65DF18CC80BAAB7B9FF46304F1451EADA49E7385E7709E418F41

Uniqueness

Uniqueness Score: -1.00%

Function 02AD06BC Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c0358b956ce37a6fc6758b1fac43e665c60d4695906dc1eac1db4825de16869
Instruction ID: b01eecd90bfa300cf97e4f322950b113577921b46855a81b91ef99cc5a3c28db
Opcode Fuzzy Hash: 5c0358b956ce37a6fc6758b1fac43e665c60d4695906dc1eac1db4825de16869
Instruction Fuzzy Hash: 42B13532E052459FEB158F68C8D0BFEBBB5EF59314F1581AAD816AB241DB349901CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00830EC2 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37471b2442589230ee815a111edd3400550805fd9c89e2740b036a706190acc6
Instruction ID: 50ccc85a337486bd9f1b8c4494b30a4487922d9bb90990d9fdca2a1e5fe632de
Opcode Fuzzy Hash: 37471b2442589230ee815a111edd3400550805fd9c89e2740b036a706190acc6
Instruction Fuzzy Hash: BDB16B32A006499FDF25CF68C895BFEBBA5FF95700F14816AE501EB241D2349D41CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0083BAE1 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 1500a49b6450b20bbd35797523e91fad44014e15591d1ae93c87d96327d85ef5
Instruction ID: 17356365fb57b5c19d73a58e860e1743a5f632ebd0d34769c127b348bf04aadb
Opcode Fuzzy Hash: 1500a49b6450b20bbd35797523e91fad44014e15591d1ae93c87d96327d85ef5
Instruction Fuzzy Hash: ADB12AB16007459BDB34AF28CC82AB7B3A8FF84318F54446DEB43C6640EB75E985CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00804150 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f2e3477134d5c6bb3adcb08173abebedf296accaf9624444c4dc55f7b7287b6
Instruction ID: 7925ea28021319c050779100d5640654c9bc185c00fb7fd3258b7dd78920db39
Opcode Fuzzy Hash: 9f2e3477134d5c6bb3adcb08173abebedf296accaf9624444c4dc55f7b7287b6
Instruction Fuzzy Hash: 7CA14CB1A401289BCB64DF58CC81BEDB7B5FB89304F5551EADA09E7381E7719E818F80

Uniqueness

Uniqueness Score: -1.00%

Function 02A9A110 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb8c61124e34b2eb9345ab2dbe0ae94046b797f52ff49ea28d99d260d0e2f93
Instruction ID: 564d3ad2d91aded1c33677b318c49e11eed768d3066de2f4a9ad6e7520d6f8cf
Opcode Fuzzy Hash: 9eb8c61124e34b2eb9345ab2dbe0ae94046b797f52ff49ea28d99d260d0e2f93
Instruction Fuzzy Hash: DAB1763180C7859BEB16CF2DC8416AAB7E0BF9930CF189759FDD862212EB31E694C741

Uniqueness

Uniqueness Score: -1.00%

Function 00801B51 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840b5a77ad91a39dc638c83b90b9d70509c78b4c9d6c6a222e3d5daa85d8efa2
Instruction ID: fc908953f25661504eb3edc80d5a6db0a60504a1163214216983b392ed92ca92
Opcode Fuzzy Hash: 840b5a77ad91a39dc638c83b90b9d70509c78b4c9d6c6a222e3d5daa85d8efa2
Instruction Fuzzy Hash: 46518071E00219AFDF54CF99C991AAEBBB2FF88324F19805DE415AB241D7349E50CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00833DFD Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92b8ea6d66fb64a22112da6f97fbd28c7b88ca35f4aab1b235990a0d775ab342
Instruction ID: 04d86eb4ddba11baf8542e7b25460123de99839f017988741745f37fb0d07c88
Opcode Fuzzy Hash: 92b8ea6d66fb64a22112da6f97fbd28c7b88ca35f4aab1b235990a0d775ab342
Instruction Fuzzy Hash: BFF0B472640224EBCB26DA9CD909B59B3A8F78EF10F154056E201EB690C6B0DF40C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 00833C23 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed10b771f29d87f5923d60a5939367821e947b51e4ea54a723e11e0477b0cb6a
Instruction ID: 3e5dc50203ee8778ffb3bfd6c73b71e27b9d4557241c1348ac3abc799509d06b
Opcode Fuzzy Hash: ed10b771f29d87f5923d60a5939367821e947b51e4ea54a723e11e0477b0cb6a
Instruction Fuzzy Hash: 29F09A31240205EFCB05DF6CCA58F1973E8F78A744F24A060E906EB290C630DF42C780

Uniqueness

Uniqueness Score: -1.00%

Function 00833D88 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e098f107ea2c56412b3c2f02981b10142ee91b2a3da243421eaa3aa51c746f6b
Instruction ID: b2fd3c355254e8fc498980928dd35f0471822c917135849c18236805de8a0587
Opcode Fuzzy Hash: e098f107ea2c56412b3c2f02981b10142ee91b2a3da243421eaa3aa51c746f6b
Instruction Fuzzy Hash: DFF03971A11264FBCB26CB8CD945A8973ECFB89B55F220096F945EB250CAB0DE44C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00833D44 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1f9e27335795904b7e186e9f4a957166ee5e92ed8a5ff3d08bc324b0feb6a5
Instruction ID: c08357714f4338dca47468b02fe140afa6e5d21c35720f6a61fe369cf1daa216
Opcode Fuzzy Hash: 0d1f9e27335795904b7e186e9f4a957166ee5e92ed8a5ff3d08bc324b0feb6a5
Instruction Fuzzy Hash: 90F06532A10324EBCB26DB4CC905B9973ACFB85B52F110096F505DB250C6B0DE40C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00833B9D Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bc6e6fed39ca2cc7ec9095dfb17ea29cafcbb534ea90e213ac4121beae9af0b
Instruction ID: c45329aee09a51bab415cea574afab67ddb83fc1c97dfb78296b9641defa371a
Opcode Fuzzy Hash: 6bc6e6fed39ca2cc7ec9095dfb17ea29cafcbb534ea90e213ac4121beae9af0b
Instruction Fuzzy Hash: 90E06531600288EFCB55CF69CA84A4EB7E8FB88795F2040A8E809C7690D734DF80CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00833BE0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c457150241492b4d2e22c76d1076e14cf4a2afa1b20ed602f1e383853aa0bf5
Instruction ID: 8335007be7abfb66a5db6d2ec58a8fed36220eb652ead9f9ae702cd788820323
Opcode Fuzzy Hash: 5c457150241492b4d2e22c76d1076e14cf4a2afa1b20ed602f1e383853aa0bf5
Instruction Fuzzy Hash: FCE06531600384EFCB0ACFA9C944A0AB7E8FB89745F2154A8E809E7650DB34DF44CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00833DCC Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d0b50f5c1755b60d15d8b32736556bdf1cbbff35e9f1474ebf1b80bec4e9ca
Instruction ID: 4a821b32825139bb78208ec6e736f6d8d4942989a5c80d83aee4f6255bd42636
Opcode Fuzzy Hash: 64d0b50f5c1755b60d15d8b32736556bdf1cbbff35e9f1474ebf1b80bec4e9ca
Instruction Fuzzy Hash: 5AE08C32911238EBCB14DB8CC94598AF3ECFB85B41F110596B901D3101C270DF00C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00833C7E Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9fb71b9a8c4f5850e043095178f0b06b91ffed8a18884ade8fe223d7ecf91d
Instruction ID: 64715d9713dad70cdec9f6d3d9ed875e5b11565802067155cf4128fe5c10872e
Opcode Fuzzy Hash: 3d9fb71b9a8c4f5850e043095178f0b06b91ffed8a18884ade8fe223d7ecf91d
Instruction Fuzzy Hash: 21E0E235501248EFCB04DBA9C549A4AB7F9FB88755F6148A4E805D7251D234EF81DA40

Uniqueness

Uniqueness Score: -1.00%

Function 0082A542 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed5555326bbdee18ba68e0189cb002a21aae07435ab097ea66acc68cd25ee0a2
Instruction ID: 5c2f133de17c88cdd8c5bfd80c5862d1dc669d620c2ab56909cf12146504f169
Opcode Fuzzy Hash: ed5555326bbdee18ba68e0189cb002a21aae07435ab097ea66acc68cd25ee0a2
Instruction Fuzzy Hash: 8FC08C3440091047CE2DC91493713B63368FBD1FC2F80048CCD028B682C51EDCCAD602

Uniqueness

Uniqueness Score: -1.00%

Function 007DF4F0 Relevance: 103.7, APIs: 54, Strings: 5, Instructions: 415stringwindowCOMMON

Download Yara Rule

APIs

GetDlgItemTextW.USER32(?,00000064,?,00000104), ref: 007DF577
GetSystemDirectoryW.KERNEL32(C:\Windows\system32\Viewers\Quikview.exe,00000104), ref: 007DF587
PathAddBackslashW.SHLWAPI(C:\Windows\system32\Viewers\Quikview.exe), ref: 007DF592
lstrcatW.KERNEL32(C:\Windows\system32\Viewers\Quikview.exe,Viewers\Quikview.exe), ref: 007DF5A2
PathQuoteSpacesW.SHLWAPI(C:\Windows\system32\Viewers\Quikview.exe), ref: 007DF5AD
lstrcpyW.KERNEL32(008EC36C,0085D420), ref: 007DF5C3
lstrcpyW.KERNEL32(C:\Windows\system32\Viewers\Quikview.exe,?), ref: 007DF5DD
StrChrW.SHLWAPI(C:\Windows\system32\Viewers\Quikview.exe,00000020), ref: 007DF61F
lstrcpyW.KERNEL32(008EC36C,-00000002), ref: 007DF637
lstrcpyW.KERNEL32(?,C:\Users\user\Documents), ref: 007DF65A
GetDlgItemTextW.USER32(?,00000066,C:\Users\user\Documents,00000104), ref: 007DF669
SHGetSpecialFolderLocation.SHELL32(00000000,00000005,?), ref: 007DF678
SHGetPathFromIDListW.SHELL32(?,C:\Users\user\Documents), ref: 007DF68B
CoTaskMemFree.OLE32(?), ref: 007DF695
GetWindowsDirectoryW.KERNEL32(C:\Users\user\Documents,00000104), ref: 007DF6A7
lstrcmpiW.KERNEL32(?,C:\Users\user\Documents), ref: 007DF6CC
SetWindowLongW.USER32(?,00000000,00000000), ref: 007DF6E8
GetDlgItem.USER32(?,00000065), ref: 007DF6FC
SendMessageW.USER32(00000000,00001603,00000000,?), ref: 007DF70B
ImageList_Destroy.COMCTL32(?), ref: 007DF71F
GetDlgItem.USER32(?,00000067), ref: 007DF724
SendMessageW.USER32(00000000,00001603,00000000,?), ref: 007DF733
ImageList_Destroy.COMCTL32(?), ref: 007DF741
SendMessageW.USER32(?,00000080,00000000,?), ref: 007DF76E
lstrcpyW.KERNEL32(?,C:\Windows\system32\Viewers\Quikview.exe), ref: 007DF7AC
PathQuoteSpacesW.SHLWAPI(?), ref: 007DF7BA
StrCatBuffW.SHLWAPI(?,0085DDEC,00000104), ref: 007DF7E2
StrCatBuffW.SHLWAPI(?,008EC36C,00000104), ref: 007DF7F6
SendDlgItemMessageW.USER32(?,00000064,000000C5,00000102,00000000), ref: 007DF807
SetDlgItemTextW.USER32(?,00000064,?), ref: 007DF81E
GetDlgItem.USER32(?,00000064), ref: 007DF82B
SHAutoComplete.SHLWAPI(00000000), ref: 007DF834
SendDlgItemMessageW.USER32(?,00000066,000000C5,00000102,00000000), ref: 007DF848
SetDlgItemTextW.USER32(?,00000066,C:\Users\user\Documents), ref: 007DF859
GetDlgItem.USER32(?,00000066), ref: 007DF863
SHAutoComplete.SHLWAPI(00000000), ref: 007DF866
GetDlgItemTextW.USER32(?,00000066,?,00000104), ref: 007DF89A
StrTrimW.SHLWAPI(?,0085DF90), ref: 007DF8AD
GetDlgItemTextW.USER32(?,00000064,?,00000104), ref: 007DF904
lstrcpyW.KERNEL32(?,?), ref: 007DF920
StrChrW.SHLWAPI(?,00000020), ref: 007DF96E
lstrcpyW.KERNEL32(?,-00000002), ref: 007DF989
LoadStringW.USER32(00002AF9,?,00000020), ref: 007DF9BE
LoadStringW.USER32(00002AF9,?,00000020), ref: 007DF9D9
LoadStringW.USER32(00002AFD,?,00000100), ref: 007DF9F3
LoadStringW.USER32(00002AFD,?,00000100), ref: 007DFA11
GetOpenFileNameW.COMDLG32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000058), ref: 007DFA61
StrCpyNW.SHLWAPI(?,?,00000104), ref: 007DFA80
PathQuoteSpacesW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000058), ref: 007DFA8E
StrCatBuffW.SHLWAPI(?,0085DDEC,00000104), ref: 007DFAB7
StrCatBuffW.SHLWAPI(?,?,00000104), ref: 007DFACE
SetDlgItemTextW.USER32(?,00000064,?), ref: 007DFADB
PostMessageW.USER32(?,00000028,00000001,00000000), ref: 007DFAE8

Strings

Viewers\Quikview.exe, xrefs: 007DF598
", xrefs: 007DF93C
X, xrefs: 007DFA26
C:\Windows\system32\Viewers\Quikview.exe, xrefs: 007DF582, 007DF58D, 007DF59D, 007DF5A8, 007DF5D8, 007DF5E1, 007DF604, 007DF609, 007DF61A, 007DF639, 007DF7A6
C:\Users\user\Documents, xrefs: 007DF64D, 007DF661, 007DF682, 007DF6A2, 007DF6B4, 007DF6BF, 007DF84E

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Item$Textlstrcpy$Message$PathSend$BuffLoadString$QuoteSpaces$AutoCompleteDestroyDirectoryImageList_$BackslashFileFolderFreeFromListLocationLongNameOpenPostSpecialSystemTaskTrimWindowWindowslstrcatlstrcmpi
String ID: "$C:\Users\user\Documents$C:\Windows\system32\Viewers\Quikview.exe$Viewers\Quikview.exe$X
API String ID: 583393450-2244557518
Opcode ID: 22e5c338e366f59e0c4281c4c66f6ee14e0fb8832f1fa4d7cb3ed272972588bf
Instruction ID: 21a155cf72d43e19b750a7f88bc9e4ace4fd0c7e10c6fac0276048a8e74963c0
Opcode Fuzzy Hash: 22e5c338e366f59e0c4281c4c66f6ee14e0fb8832f1fa4d7cb3ed272972588bf
Instruction Fuzzy Hash: 28E1B371A44345ABE730DB60DC49FAB77B8FB85B04F00442AFA55D72E0EBB49845CB52

Uniqueness

Uniqueness Score: -1.00%

Function 007EEDA0 Relevance: 103.6, APIs: 53, Strings: 6, Instructions: 387stringwindowCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32(?,?,?), ref: 007EEDCC
GetCurrentDirectoryW.KERNEL32(00000104,?,?,?), ref: 007EEDE8
PathFileExistsW.SHLWAPI(?), ref: 007EEDF2
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 007EEE09
SetCurrentDirectoryW.KERNEL32(?), ref: 007EEE17
LoadCursorW.USER32(00000000,00007F02), ref: 007EEE3B
SetCursor.USER32(00000000), ref: 007EEE42
DestroyCursor.USER32(00000000), ref: 007EEE49
SendMessageW.USER32(00001027,00000000,00000000), ref: 007EEE64
GetCurrentDirectoryW.KERNEL32(0000012C,008EBF0C), ref: 007EEE74
PathIsRootW.SHLWAPI(008EBF0C), ref: 007EEEA6
SHGetFileInfoW.SHELL32(008EBF0C,00000000,?,000002B4,00000200), ref: 007EEEE0
PathFindFileNameW.SHLWAPI(008EBF0C), ref: 007EEEF8
lstrcpyW.KERNEL32(?,00000000), ref: 007EEF07
lstrcpyW.KERNEL32(?,008EBF0C), ref: 007EEF2D
PathRemoveFileSpecW.SHLWAPI(?), ref: 007EEF37
lstrcatW.KERNEL32(?, - [), ref: 007EEF50
lstrcatW.KERNEL32(?,?), ref: 007EEF62
lstrlenW.KERNEL32(00000000), ref: 007EEF77
lstrcatW.KERNEL32(?,0085E27C), ref: 007EEF95
SetWindowTextW.USER32(?,?), ref: 007EEFC2
lstrcmpW.KERNEL32(008ED39C,*.*,?,?), ref: 007EEFD2
SendMessageW.USER32(00001024,00000000,00000000), ref: 007EF021
SendMessageW.USER32(00000440,0000A41E,00000020), ref: 007EF0AF
GetPropW.USER32(?,DirListData), ref: 007EF0F8
ResetEvent.KERNEL32(?,?,?,?,?,?,?), ref: 007EF10F
ResetEvent.KERNEL32(?,?,?,?,?,?,?), ref: 007EF117
GetPropW.USER32(DirListData), ref: 007EF134
SHGetPathFromIDListW.SHELL32(?,?), ref: 007EF141
lstrcpyW.KERNEL32(008EBF0C,?), ref: 007EF158
SetCurrentDirectoryW.KERNEL32(008EBF0C,?,?,?,?,?,?,?,?,?), ref: 007EF163
SendMessageW.USER32(0000102B,00000000,?), ref: 007EF193

Strings

, xrefs: 007EF023
*.*, xrefs: 007EEFC8, 007EF240
DirListData, xrefs: 007EF0F2, 007EF129
\, xrefs: 007EEF7D
- [, xrefs: 007EEF4A
, xrefs: 007EF082

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Directory$CurrentPath$FileMessageSend$Cursorlstrcatlstrcpy$EventPropReset$DestroyExistsFindFromInfoListLoadNameRemoveRootSpecTextWindowWindowslstrcmplstrlen
String ID: $ $ - [$*.*$DirListData$\
API String ID: 2993255122-2785365950
Opcode ID: d94d720f54664bfacf24d0f10c33e93dfd1ca2e086afa6154f0d9ade0669ba11
Instruction ID: 4ed560006b4f892a7885c31ad876f0f955d2d7202d36af3458ce14d4198b6cca
Opcode Fuzzy Hash: d94d720f54664bfacf24d0f10c33e93dfd1ca2e086afa6154f0d9ade0669ba11
Instruction Fuzzy Hash: 7AE1C675644384ABD7209F61EC89F9B7BA8FB0A705F040829F644D62F1DBB8E544CF52

Uniqueness

Uniqueness Score: -1.00%

Function 007E1F70 Relevance: 75.3, APIs: 50, Instructions: 333windowthreadCOMMON

Download Yara Rule

APIs

ReleaseCapture.USER32 ref: 007E1FE1
SendMessageW.USER32(?,00000202,00000000,00000000), ref: 007E1FF1
GetDlgItemTextW.USER32(?,00000066,?,00000104), ref: 007E2043
PathQuoteSpacesW.SHLWAPI(?), ref: 007E2062
GetParent.USER32(?), ref: 007E2070
SetDlgItemTextW.USER32(00000000), ref: 007E2077
GetDlgItemTextW.USER32(?,00000065,?,00000104), ref: 007E208A
DestroyCursor.USER32 ref: 007E20D5
DestroyCursor.USER32 ref: 007E20DD
DestroyCursor.USER32 ref: 007E20E5
EndDialog.USER32(?,00000001), ref: 007E20EE
LoadIconW.USER32(0000006B), ref: 007E2124
LoadIconW.USER32(0000006C), ref: 007E2133
LoadCursorW.USER32(00000064), ref: 007E2142
SendMessageW.USER32(?,00000080,00000000,?), ref: 007E215F
ReleaseCapture.USER32 ref: 007E2192
GetCursorPos.USER32(?), ref: 007E21B9
WindowFromPoint.USER32(?,?), ref: 007E21C7
GetWindowLongW.USER32(00000000,000000F0), ref: 007E21D8
GetParent.USER32(00000000), ref: 007E21E2
GetWindowLongW.USER32(00000000,000000F0), ref: 007E21ED
GetWindowTextW.USER32(00000000,?,00000100), ref: 007E2209
SetDlgItemTextW.USER32(?,00000064,?), ref: 007E221D
GetClassNameW.USER32(00000000,?,00000100), ref: 007E222A
SetDlgItemTextW.USER32(?,00000065,?), ref: 007E2238
GetWindowThreadProcessId.USER32(00000000,?), ref: 007E2248
OpenProcess.KERNEL32(00000410,00000000,?), ref: 007E2259
EnumProcessModules.PSAPI(00000000,?,00000004,00000000), ref: 007E226E
GetModuleFileNameExW.PSAPI(00000000,?,?,00000100), ref: 007E2283
CloseHandle.KERNEL32(00000000), ref: 007E228A
SetDlgItemTextW.USER32(?,00000066,?), ref: 007E2298
SetDlgItemTextW.USER32(?,00000064,0085D420), ref: 007E22AD
SetDlgItemTextW.USER32(?,00000065,0085D420), ref: 007E22B7
SetDlgItemTextW.USER32(?,00000066,0085D420), ref: 007E22C1
LoadCursorW.USER32(?,00007F00), ref: 007E22E2
SetCursor.USER32(00000000), ref: 007E22E9
SendDlgItemMessageW.USER32(?,00000067,00000170,00000000), ref: 007E22FF
ReleaseCapture.USER32 ref: 007E2305
GetDlgItemTextW.USER32(?,00000065,?,00000100), ref: 007E2322
GetDlgItem.USER32(?,00000001), ref: 007E2332
EnableWindow.USER32(00000000), ref: 007E2335
GetDlgItem.USER32(?,00000001), ref: 007E233E
IsWindowEnabled.USER32(00000000), ref: 007E2341
GetDlgItem.USER32(?,00000001), ref: 007E2350
PostMessageW.USER32(?,00000028,00000000), ref: 007E2356
ChildWindowFromPoint.USER32(?,?,?), ref: 007E2367
GetDlgCtrlID.USER32(00000000), ref: 007E236E
SetCapture.USER32(?), ref: 007E237A
SetCursor.USER32 ref: 007E2390
SendDlgItemMessageW.USER32(?,00000067,00000170,00000000), ref: 007E23A6

Part of subcall function 007E5CA0: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 007E5CE5
Part of subcall function 007E5CA0: PathRemoveFileSpecW.SHLWAPI(?), ref: 007E5CF3
Part of subcall function 007E5CA0: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 007E5D06
Part of subcall function 007E5CA0: SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?), ref: 007E5D19
Part of subcall function 007E5CA0: PathIsRelativeW.SHLWAPI(C:\Windows\system32\Viewers\Quikview.exe), ref: 007E5D2E
Part of subcall function 007E5CA0: PathIsPrefixW.SHLWAPI(?,?), ref: 007E5D4B
Part of subcall function 007E5CA0: PathIsPrefixW.SHLWAPI(?,C:\Windows\system32\Viewers\Quikview.exe), ref: 007E5D57
Part of subcall function 007E5CA0: PathRelativePathToW.SHLWAPI(?,?,00000010,C:\Windows\system32\Viewers\Quikview.exe,?), ref: 007E5D72
Part of subcall function 007E5CA0: lstrcpyW.KERNEL32(?,%CSIDL:MYDOCUMENTS%), ref: 007E5D8C
Part of subcall function 007E5CA0: PathAppendW.SHLWAPI(?,?), ref: 007E5D9B
Part of subcall function 007E5CA0: lstrcpyW.KERNEL32(?,?), ref: 007E5DAE
Part of subcall function 007E5CA0: PathUnExpandEnvStringsW.SHLWAPI(?,?,00000104), ref: 007E5E1F
Part of subcall function 007E5CA0: lstrcpynW.KERNEL32(?,?,00000104), ref: 007E5E3E

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Item$Text$Path$CursorWindow$Message$CaptureLoadSend$DestroyFileNameProcessRelease$FromIconLongModuleParentPointPrefixRelativelstrcpy$AppendChildClassCloseCtrlDialogDirectoryEnableEnabledEnumExpandFolderHandleModulesOpenPostQuoteRemoveSpacesSpecStringsThreadWindowslstrcpyn
String ID:
API String ID: 4248756809-0
Opcode ID: 61e54665501c2286276ecfe836cf0e8cb52ef4867703b3a4e84421ab113450e5
Instruction ID: 204c3735453e41e096916e76a2fce2b316b9800c5facdf379a6565aa1213f5f0
Opcode Fuzzy Hash: 61e54665501c2286276ecfe836cf0e8cb52ef4867703b3a4e84421ab113450e5
Instruction Fuzzy Hash: 91B1D2B5600344ABE7209F74EC89F6A3BACFB4D714F010919FA45D61E1EBB9D901CB61

Uniqueness

Uniqueness Score: -1.00%

Function 007DEE20 Relevance: 72.3, APIs: 48, Instructions: 305windowCOMMON

Download Yara Rule

APIs

IsDlgButtonChecked.USER32(?,?), ref: 007DEE54
GetDlgItem.USER32(?,00000065), ref: 007DEE69
EnableWindow.USER32(00000000), ref: 007DEE72
GetDlgItem.USER32(?,00000066), ref: 007DEE79
EnableWindow.USER32(00000000), ref: 007DEE7C
GetDlgItem.USER32(?,00000065), ref: 007DEE8E
EnableWindow.USER32(00000000), ref: 007DEE97
GetDlgItem.USER32(?,00000066), ref: 007DEE9E
EnableWindow.USER32(00000000), ref: 007DEEA1
IsDlgButtonChecked.USER32(?,?), ref: 007DEEBD
GetDlgItem.USER32(?,0000006C), ref: 007DEED2
EnableWindow.USER32(00000000), ref: 007DEEDB
GetDlgItem.USER32(?,0000006D), ref: 007DEEE2
EnableWindow.USER32(00000000), ref: 007DEEE5
SendMessageW.USER32(?,00000080,00000000,?), ref: 007DEF2D
CheckDlgButton.USER32(?,00000067,00000001), ref: 007DEF47
CheckDlgButton.USER32(?,00000068,00000001), ref: 007DEF57
CheckDlgButton.USER32(?,00000069,00000001), ref: 007DEF67
CheckDlgButton.USER32(?,0000006A,00000001), ref: 007DEF77
CheckDlgButton.USER32(?,00000064,00000001), ref: 007DEF8E
CheckRadioButton.USER32(?,00000065,00000066,00000065), ref: 007DEFA6
CheckDlgButton.USER32(?,0000006B,00000001), ref: 007DEFEE
CheckRadioButton.USER32(?,0000006C,0000006D,0000006C), ref: 007DF000
IsDlgButtonChecked.USER32(?,00000067), ref: 007DF074
IsDlgButtonChecked.USER32(?,00000068), ref: 007DF084
IsDlgButtonChecked.USER32(?,00000069), ref: 007DF094
IsDlgButtonChecked.USER32(?,0000006A), ref: 007DF0A4
IsDlgButtonChecked.USER32(?,00000064), ref: 007DF0B4
IsDlgButtonChecked.USER32(?,00000065), ref: 007DF0BD
IsDlgButtonChecked.USER32(?,0000006B), ref: 007DF0DA
IsDlgButtonChecked.USER32(?,0000006C), ref: 007DF0E3
SetWindowLongW.USER32(?,00000000,00000000), ref: 007DF102

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Button$Checked$Check$Window$EnableItem$Radio$LongMessageSend
String ID:
API String ID: 1884937005-0
Opcode ID: bea24463b0f4892517f2d9602e5e6ef146d23c013f52f60cc953782537f2cf4e
Instruction ID: c6bec1ddaf39edd986cba61adb55febea105fe23ecddf13e9b34cbe910e9df1f
Opcode Fuzzy Hash: bea24463b0f4892517f2d9602e5e6ef146d23c013f52f60cc953782537f2cf4e
Instruction Fuzzy Hash: A981A472781715BAF6306B34AC8AFAB266DBB41B15F014422F301EF2D1D7FB9851CA64

Uniqueness

Uniqueness Score: -1.00%

Function 007EF3A0 Relevance: 70.4, APIs: 39, Strings: 1, Instructions: 370stringmemoryCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?,75AFB1B0,?,?,?,007E877D), ref: 007EF3A5
StrChrW.SHLWAPI(00000000,00000009,?,?,?,007E877D), ref: 007EF3C9
StrChrW.SHLWAPI(00000000,00000009,?,?,?,007E877D), ref: 007EF3DA
lstrlenW.KERNEL32(00000000,?,?,?,007E877D), ref: 007EF3EC
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,007E877D), ref: 007EF3FE
lstrlenW.KERNEL32(00000000,?,?,?,007E877D), ref: 007EF403
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,007E877D), ref: 007EF40F
lstrcpyW.KERNEL32(00000000,00000000), ref: 007EF41B
StrChrW.SHLWAPI(00000000,00000020,?,?,?,007E877D), ref: 007EF453
lstrcpyW.KERNEL32(00000000,-00000002), ref: 007EF467
lstrcpyW.KERNEL32(00000000,00000000), ref: 007EF495
StrChrW.SHLWAPI(00000000,00000020,?,?,?,007E877D), ref: 007EF4CB
lstrcpyW.KERNEL32(00000000,-00000002), ref: 007EF4DF
GlobalFree.KERNEL32(?), ref: 007EF513
GlobalAlloc.KERNEL32(00000040,0000020C,?,?,?,007E877D), ref: 007EF520
lstrcpyW.KERNEL32(00000000,00000000), ref: 007EF52D
StrTrimW.SHLWAPI(00000000,0085E724,?,?,?,007E877D), ref: 007EF53A
CharUpperW.USER32(00000000,?,?,?,007E877D), ref: 007EF541
CharUpperW.USER32(00000002,?,?,?,007E877D), ref: 007EF599
lstrcpyW.KERNEL32(00000000,00000000), ref: 007EF5AB
StrChrW.SHLWAPI(00000000,00000020,?,?,?,007E877D), ref: 007EF5E1
lstrcpyW.KERNEL32(00000000,-00000002), ref: 007EF5F5
StrCpyNW.SHLWAPI(008E8DE8,00000000,00000104,?,?,?,007E877D), ref: 007EF61D
PathUnquoteSpacesW.SHLWAPI(008E8DE8,?,?,?,007E877D), ref: 007EF632
lstrcpyW.KERNEL32(008E8DE8,0085D624), ref: 007EF647
CharUpperW.USER32(00000002,00000022,?,?,?,007E877D), ref: 007EF652
CharUpperW.USER32(00000002,?,?,?,007E877D), ref: 007EF663
lstrcpyW.KERNEL32(00000000,00000000), ref: 007EF67B
StrChrW.SHLWAPI(00000000,00000020,?,?,?,007E877D), ref: 007EF6B1
lstrcpyW.KERNEL32(00000000,-00000002), ref: 007EF6C5

Part of subcall function 007E6380: CharNextW.USER32(?,?,775DF670,?,007DF938), ref: 007E63A1
Part of subcall function 007E6380: lstrlenW.KERNEL32(?,?,775DF670,?,007DF938), ref: 007E63B2
Part of subcall function 007E6380: lstrlenW.KERNEL32(?,?,?,007DF938), ref: 007E63C7
Part of subcall function 007E6380: CharPrevW.USER32(?,00000000,?,?,007DF938), ref: 007E63D4
Part of subcall function 007E6380: CharPrevW.USER32(?,00000000,?,?,007DF938), ref: 007E63E7

lstrcpyW.KERNEL32(00000000,00000000), ref: 007EF783
StrChrW.SHLWAPI(00000000,00000020,?,?,?,007E877D), ref: 007EF7B9
lstrcpyW.KERNEL32(00000000,-00000002), ref: 007EF7CD
GlobalFree.KERNEL32(00000000), ref: 007EF7F4
lstrlenW.KERNEL32(00000000,?,?,?,007E877D), ref: 007EF7FB
GlobalAlloc.KERNEL32(00000040,00000000,?,?,?,007E877D), ref: 007EF80B
lstrcpyW.KERNEL32(00000000,00000000), ref: 007EF818
LocalFree.KERNEL32(00000000,?,?,?,007E877D), ref: 007EF826
LocalFree.KERNEL32(00000000,?,?,?,007E877D), ref: 007EF829

Strings

%i,%i,%i,%i, xrefs: 007EF6F6

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: lstrcpy$Char$lstrlen$AllocFreeGlobalLocalUpper$Prev$CommandLineNextPathSpacesTrimUnquote
String ID: %i,%i,%i,%i
API String ID: 792320778-2825437791
Opcode ID: d7c673a76c9e40702986a661ca23d8577748cb64a61e0518520f3d570048d091
Instruction ID: 6d078e7068b41c6d84e1761573a2084acf103aa7b2e9459fb1614a6f2f38f4cb
Opcode Fuzzy Hash: d7c673a76c9e40702986a661ca23d8577748cb64a61e0518520f3d570048d091
Instruction Fuzzy Hash: 9CB184217023C2E7EB112B6B9C99B7F2699BF9E740F14043AE505DB6D1EFBC88018756

Uniqueness

Uniqueness Score: -1.00%

Function 007DF120 Relevance: 61.5, APIs: 34, Strings: 1, Instructions: 265windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,00000000,00000000), ref: 007DF181
DeleteObject.GDI32 ref: 007DF1A0
DeleteObject.GDI32 ref: 007DF1A8
SendMessageW.USER32(?,00000080,00000000,?), ref: 007DF1CA
CreateSolidBrush.GDI32(00000000), ref: 007DF201
CreateSolidBrush.GDI32 ref: 007DF20E
CheckRadioButton.USER32(?,00000064,00000065,00000064), ref: 007DF22B
GetDlgItem.USER32(?,00000067), ref: 007DF232
EnableWindow.USER32(00000000), ref: 007DF239
CheckRadioButton.USER32(?,00000064,00000065,00000065), ref: 007DF248
CheckRadioButton.USER32(?,00000068,00000069,00000068), ref: 007DF25A
GetDlgItem.USER32(?,0000006B), ref: 007DF261
EnableWindow.USER32(00000000), ref: 007DF268
CheckRadioButton.USER32(?,00000068,00000069,00000069), ref: 007DF282
GetDlgCtrlID.USER32(?), ref: 007DF2B1
GetDlgCtrlID.USER32(?), ref: 007DF2D3

Strings

$, xrefs: 007DF45C

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ButtonCheckRadio$Window$BrushCreateCtrlDeleteEnableItemObjectSolid$LongMessageSend
String ID: $
API String ID: 3681293412-3993045852
Opcode ID: f5c4c6ac237992fdd04cf81eec5b889e04b98a626c5920c96864f3f88dfd6bc7
Instruction ID: 11d2ec2ba42656754be63ca9c52a8d8dcc54ccc403ed8b2294358ecc158f36a3
Opcode Fuzzy Hash: f5c4c6ac237992fdd04cf81eec5b889e04b98a626c5920c96864f3f88dfd6bc7
Instruction Fuzzy Hash: 3DA19F75600340AFD724DF64EC89B5B3BF4BB89B14F00442AF545AA3E0D7B9A485CF92

Uniqueness

Uniqueness Score: -1.00%

Function 007DEA00 Relevance: 59.7, APIs: 27, Strings: 7, Instructions: 191windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000001), ref: 007DEA53
SendMessageW.USER32(?,00000080,00000000,?), ref: 007DEA75
SetDlgItemTextW.USER32(?,00000064,MiniPath (x86) 1 Build 191), ref: 007DEA89
SetDlgItemTextW.USER32(?,00000065,0085DE28), ref: 007DEA93
SetDlgItemTextW.USER32(?,00000068,Florian Balmer et al. ( metapath )), ref: 007DEA9D
DeleteObject.GDI32(?), ref: 007DEAA9
SendDlgItemMessageW.USER32(?,00000064,00000031,00000000,00000000), ref: 007DEABE
GetStockObject.GDI32(00000011), ref: 007DEACB
GetObjectW.GDI32(00000000,0000005C,?), ref: 007DEADE
CreateFontIndirectW.GDI32(?), ref: 007DEB01
SendDlgItemMessageW.USER32(?,00000064,00000030,00000000,00000001), ref: 007DEB14
GetDlgItem.USER32(?,00000066), ref: 007DEB1F
SetDlgItemTextW.USER32(?,00000067,https://www.rizonesoft.com), ref: 007DEB2D
GetDlgItem.USER32(?,00000067), ref: 007DEB34
ShowWindow.USER32(00000000), ref: 007DEB37
wsprintfW.USER32 ref: 007DEB49
SetDlgItemTextW.USER32(?,00000066,?), ref: 007DEB5A
GetDlgItem.USER32(?,00000069), ref: 007DEB5F
SetDlgItemTextW.USER32(?,0000006A,https://www.flos-freeware.ch), ref: 007DEB6D
GetDlgItem.USER32(?,0000006A), ref: 007DEB74
ShowWindow.USER32(00000000), ref: 007DEB77
wsprintfW.USER32 ref: 007DEB89
SetDlgItemTextW.USER32(?,00000069,?), ref: 007DEB9A
LoadStringW.USER32(0000C366,?,00000100), ref: 007DEBB7
LoadStringW.USER32(0000C366,?,00000100), ref: 007DEBD2
SetDlgItemTextW.USER32(?,00000072,?), ref: 007DEBDC
ShellExecuteW.SHELL32(?,open,mailto:florian.balmer@gmail.com,00000000,00000000,00000001), ref: 007DEC2B

Strings

https://www.flos-freeware.ch, xrefs: 007DEB61, 007DEC0E
MiniPath (x86) 1 Build 191, xrefs: 007DEA81
open, xrefs: 007DEC25
https://www.rizonesoft.com, xrefs: 007DEB21
mailto:florian.balmer@gmail.com, xrefs: 007DEC20
<A>%s</A>, xrefs: 007DEB43, 007DEB83
Florian Balmer et al. ( metapath ), xrefs: 007DEA95

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Item$Text$MessageObjectSend$LoadShowStringWindowwsprintf$CreateDeleteDialogExecuteFontIndirectShellStock
String ID: <A>%s</A>$Florian Balmer et al. ( metapath )$MiniPath (x86) 1 Build 191$https://www.flos-freeware.ch$https://www.rizonesoft.com$mailto:florian.balmer@gmail.com$open
API String ID: 2852744854-2807268571
Opcode ID: e273d082d95cc26beb2a3864113f288ef8887511ce6bb3cba7ae95d5cc8faed5
Instruction ID: 7118faa6dae7df591e9aec994c9ac1da70b8d735bf13b4b5cd6025fcaf75f26a
Opcode Fuzzy Hash: e273d082d95cc26beb2a3864113f288ef8887511ce6bb3cba7ae95d5cc8faed5
Instruction Fuzzy Hash: D351C570644B05BBE631AB749C8AF6B37ACFF45B04F000416F615EE2D0D7E9E905CA66

Uniqueness

Uniqueness Score: -1.00%

Function 007E2739 Relevance: 56.2, APIs: 23, Strings: 9, Instructions: 231stringCOMMON

Download Yara Rule

APIs

IsDlgButtonChecked.USER32(?,00000065), ref: 007E2742
GetDlgItemTextW.USER32(?,00000066,?,00000104), ref: 007E275D
IsDlgButtonChecked.USER32(?,00000069), ref: 007E2766
IsDlgButtonChecked.USER32(?,0000006A), ref: 007E277F
GetDlgItemTextW.USER32(?,0000006C,?,00000104), ref: 007E2794
GetDlgItemTextW.USER32(?,0000006D,?,00000104), ref: 007E27A9
GetDlgItemTextW.USER32(?,0000006E,?,00000104), ref: 007E27BE
IsDlgButtonChecked.USER32(?,00000064), ref: 007E27EC
GetDlgItemTextW.USER32(?,00000066,?,00000104), ref: 007E2835
lstrcpyW.KERNEL32(008E96C0,0085D420), ref: 007E2867
lstrcpyW.KERNEL32(008E98D0,0085D420), ref: 007E2873
IsDlgButtonChecked.USER32(?,00000068), ref: 007E28BD
IsDlgButtonChecked.USER32(?,00000069), ref: 007E28D9
IsDlgButtonChecked.USER32(?,00000069), ref: 007E2910
lstrcpyW.KERNEL32(008E92B0,0085D420), ref: 007E2944
IsDlgButtonChecked.USER32(?,0000006A), ref: 007E2960
GetDlgItemTextW.USER32(?,0000006C,008E9AE0,00000100), ref: 007E2983
lstrcpyW.KERNEL32(008E9AE0,0085D420), ref: 007E2991
GetDlgItemTextW.USER32(?,0000006D,008E90A0,00000100), ref: 007E29C0
lstrcpyW.KERNEL32(008E90A0,0085D420), ref: 007E29CE
GetDlgItemTextW.USER32(?,0000006E,008E94C0,00000100), ref: 007E29FD
lstrcpyW.KERNEL32(008E94C0,0085D420), ref: 007E2A0B
EndDialog.USER32(?,00000001), ref: 007E2A43

Strings

TargetApplicationPath, xrefs: 007E287A
TargetApplicationMode, xrefs: 007E28FB
UseTargetApplication, xrefs: 007E280B
TargetApplicationWndClass, xrefs: 007E294B
Target Application, xrefs: 007E2810, 007E287F, 007E2896, 007E2900, 007E2950, 007E299D, 007E29DA, 007E2A17
DDEApplication, xrefs: 007E29D5
DDETopic, xrefs: 007E2A12
DDEMessage, xrefs: 007E2998
TargetApplicationParams, xrefs: 007E2891

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ButtonCheckedItemText$lstrcpy$Dialog
String ID: DDEApplication$DDEMessage$DDETopic$Target Application$TargetApplicationMode$TargetApplicationParams$TargetApplicationPath$TargetApplicationWndClass$UseTargetApplication
API String ID: 469813264-1845030746
Opcode ID: 64d1200aee4116f55bbcc8d4cf99782da4a8c31435a019023547b312306b03d3
Instruction ID: f1c475ad73f1003e8b447322935cb6e619615b62d07e3620a84df206e96d7308
Opcode Fuzzy Hash: 64d1200aee4116f55bbcc8d4cf99782da4a8c31435a019023547b312306b03d3
Instruction Fuzzy Hash: 6C713770740384BAEB245B625C86F7E3129F719B05F004035FA52E92D2DAFD9D8AD662

Uniqueness

Uniqueness Score: -1.00%

Function 007DFEA0 Relevance: 54.5, APIs: 28, Strings: 3, Instructions: 249windowstringCOMMON

Download Yara Rule

APIs

CreatePopupMenu.USER32 ref: 007DFF12
GetDlgItemTextW.USER32(?,00000064,008E9F48,00000200), ref: 007DFF2A
CheckMenuRadioItem.USER32(00000000,0000FFFF,00000400), ref: 007DFF59
GetDlgItem.USER32(?,00000065), ref: 007DFF74
GetWindowRect.USER32(00000000), ref: 007DFF7B
TrackPopupMenuEx.USER32(00000102,?,?,?,00000000), ref: 007DFF9B
GetMenuStringW.USER32(00000000,?,00000100,00000000), ref: 007DFFBF
SetDlgItemTextW.USER32(?,00000064,00000000), ref: 007E000A
CheckDlgButton.USER32(?,00000066,00000001), ref: 007E0015
SetDlgItemTextW.USER32(?,00000064,0000002D), ref: 007E0025
CheckDlgButton.USER32(?,00000066,00000000), ref: 007E0030
DestroyMenu.USER32 ref: 007E0057
GetDlgItem.USER32(?,00000064), ref: 007E006C
PostMessageW.USER32(?,00000028,00000000), ref: 007E0076
EndDialog.USER32(?,00000002), ref: 007E0099
GetDlgItemTextW.USER32(?,00000064,008ED39C,000000FF), ref: 007E00C6
IsDlgButtonChecked.USER32(?,00000066), ref: 007E00D3
EndDialog.USER32(?,00000001), ref: 007E00E7
lstrcpyW.KERNEL32(008ED39C,*.*), ref: 007E0111
EndDialog.USER32(?,00000001), ref: 007E0124
SendMessageW.USER32(?,00000080,00000000,?), ref: 007E0156
SendDlgItemMessageW.USER32(?,00000064,000000C5,000000FF,00000000), ref: 007E0181
SetDlgItemTextW.USER32(?,00000064,008ED39C), ref: 007E018F
CheckDlgButton.USER32(?,00000066,00000000), ref: 007E01A4
GetDlgItem.USER32(?,00000065), ref: 007E01CE
SendMessageW.USER32(00000000,00001603,00000000,?), ref: 007E01E1
ImageList_Destroy.COMCTL32(?), ref: 007E01EF

Strings

Filters, xrefs: 007DFFCE
-, xrefs: 007DFFF2
*.*, xrefs: 007E0107

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Item$MenuText$ButtonCheckMessage$DialogSend$DestroyPopup$CheckedCreateImageList_PostRadioRectStringTrackWindowlstrcpy
String ID: *.*$-$Filters
API String ID: 2651413375-1911857017
Opcode ID: b68d881e49f718bd5fee72d27f604a6444c3dedd90ddb0197c6c2108246074d4
Instruction ID: b1a7a8344d9566c197ca5bca543bfae0a22285dff7352da45d3ea964559a9606
Opcode Fuzzy Hash: b68d881e49f718bd5fee72d27f604a6444c3dedd90ddb0197c6c2108246074d4
Instruction Fuzzy Hash: 3881E475241344ABE3209F64EC4EFBA37A8FB0D705F000419F645DA2D1EBF99954CB96

Uniqueness

Uniqueness Score: -1.00%

Function 007D4450 Relevance: 54.5, APIs: 25, Strings: 6, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,75AFB1B0), ref: 007D4476
lstrcmpiW.KERNEL32(008E8DE8,0085D624), ref: 007D4494
ExpandEnvironmentStringsW.KERNEL32(008E8DE8,?,00000138), ref: 007D44DD
lstrcpynW.KERNEL32(008E8DE8,?,00000104), ref: 007D44F9
PathIsRelativeW.SHLWAPI(008E8DE8), ref: 007D4504
lstrcpyW.KERNEL32(?,?), ref: 007D4521
PathRemoveFileSpecW.SHLWAPI(?), ref: 007D4528
PathAppendW.SHLWAPI(?,008E8DE8), ref: 007D4538
lstrcpyW.KERNEL32(008E8DE8,?), ref: 007D4548
PathFindFileNameW.SHLWAPI(?), ref: 007D4575
lstrcpyW.KERNEL32(?,00000000), ref: 007D4583
PathRenameExtensionW.SHLWAPI(?,.ini), ref: 007D4595
lstrcpyW.KERNEL32(?,minipath.ini), ref: 007D45B5
lstrcpyW.KERNEL32(008E8DE8,?), ref: 007D45D8
PathRenameExtensionW.SHLWAPI(008E8DE8,.ini), ref: 007D45E4
PathRemoveFileSpecW.SHLWAPI(?), ref: 007D463E
lstrcatW.KERNEL32(?,\Notepad3.exe), ref: 007D4651
PathFindFileNameW.SHLWAPI(?), ref: 007D465F
lstrcpyW.KERNEL32(?,00000000), ref: 007D4667
PathRenameExtensionW.SHLWAPI(?,.ini), ref: 007D4673
lstrcpyW.KERNEL32(?,notepad3.ini), ref: 007D4695
lstrcpyW.KERNEL32(008E8BE0,?), ref: 007D46BA
PathRenameExtensionW.SHLWAPI(008E8BE0,.ini), ref: 007D46C6

Strings

notepad3.ini, xrefs: 007D468B, 007D46D1, 007D46F4
minipath, xrefs: 007D45F9, 007D461C
.ini, xrefs: 007D458F, 007D45DA, 007D4669, 007D46BC
notepad3, xrefs: 007D46DB, 007D46FE
minipath.ini, xrefs: 007D45AB, 007D45EF, 007D4612
\Notepad3.exe, xrefs: 007D4644

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Path$lstrcpy$File$ExtensionRename$Name$FindRemoveSpec$AppendEnvironmentExpandModuleRelativeStringslstrcatlstrcmpilstrcpyn
String ID: .ini$\Notepad3.exe$minipath$minipath.ini$notepad3$notepad3.ini
API String ID: 3294106345-3709775904
Opcode ID: bf576b93f82da336af651914a6f0577c0c71f03bec7126bd8dc9dab50be718cf
Instruction ID: 615da884369983c1729edf72b16ee83ad49e3f6bd9ba1f2a43ecaee15a72da1a
Opcode Fuzzy Hash: bf576b93f82da336af651914a6f0577c0c71f03bec7126bd8dc9dab50be718cf
Instruction Fuzzy Hash: D36181B16443499BC720DFA1DC89DDB73ECFBE5301F40082AB959D3290EE78D54D8AA2

Uniqueness

Uniqueness Score: -1.00%

Function 007E8940 Relevance: 49.3, APIs: 22, Strings: 6, Instructions: 303windowstringCOMMON

Download Yara Rule

APIs

MonitorFromRect.USER32(?,00000002), ref: 007E89B9
GetMonitorInfoW.USER32(00000000,?), ref: 007E89D3
SetRect.USER32(00000028,?,?,?,?), ref: 007E8AAF
IntersectRect.USER32(?,?,?), ref: 007E8ACD
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 007E8B31
CreateWindowExW.USER32(00000000,MiniPath,MinPath,82CC0000,?,?,00000110,00000280,00000000,00000000,?,00000000), ref: 007E8B84
SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000003), ref: 007E8BA8
GetWindowLongW.USER32(00000000,000000EC), ref: 007E8BC6
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 007E8BD5
MulDiv.KERNEL32(?,000000FF,00000064), ref: 007E8BE3
SetLayeredWindowAttributes.USER32(00000000,00000000,?,00000002), ref: 007E8BF6
GetWindowLongW.USER32(00000000,000000EC), ref: 007E8BFE
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 007E8C0D
ShowWindow.USER32(?), ref: 007E8C29
UpdateWindow.USER32 ref: 007E8C35
ShowWindow.USER32(00000000), ref: 007E8C48
LoadImageW.USER32(00000064,00000001,00000010,00000010,?), ref: 007E8C6D
lstrcpyW.KERNEL32 ref: 007E8CC1
Shell_NotifyIconW.SHELL32(00000000,000003BC), ref: 007E8CCE
GlobalFree.KERNEL32 ref: 007E8CEE
SendMessageW.USER32(00001004,00000000,00000000), ref: 007E8D7E
PostMessageW.USER32(00000111,00019D0D,00000000), ref: 007E8D99

Strings

MiniPath, xrefs: 007E8B7D, 007E8CAF
(, xrefs: 007E89C6
MRUDirectory, xrefs: 007E8D1B
Settings, xrefs: 007E8D10
C:\Users\user\Documents, xrefs: 007E8D65
MinPath, xrefs: 007E8B78

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Window$Long$Rect$InfoMessageMonitorShow$AttributesCreateFreeFromGlobalIconImageIntersectLayeredLoadNotifyParametersPostSendShell_SystemUpdatelstrcpy
String ID: ($C:\Users\user\Documents$MRUDirectory$MinPath$MiniPath$Settings
API String ID: 3277733087-3121419884
Opcode ID: 079fd574454e63d15b080443a1e252a20557f41bbd1814977dce869c09bc7b0a
Instruction ID: e6b6a1b5b5ead17e60390eeeee4490bca3ba6703b800073fd10002a347452d00
Opcode Fuzzy Hash: 079fd574454e63d15b080443a1e252a20557f41bbd1814977dce869c09bc7b0a
Instruction Fuzzy Hash: A4C123B06053859FD730CF24DC84BAAB7E8FB89704F10462DF648972E0DB74A948CB96

Uniqueness

Uniqueness Score: -1.00%

Function 007EFAB0 Relevance: 48.3, APIs: 32, Instructions: 259windowstringCOMMON

Download Yara Rule

APIs

Part of subcall function 007E6080: CoCreateInstance.OLE32(0085378C,00000000,00000001,0084FD7C,?,0000C356,?), ref: 007E60AF
Part of subcall function 007E6080: lstrcpyW.KERNEL32(?,?), ref: 007E60DB
Part of subcall function 007E6080: ExpandEnvironmentStringsW.KERNEL32(?,?,00000138), ref: 007E6152
Part of subcall function 007E6080: lstrcpynW.KERNEL32(?,?,?), ref: 007E616C

PathFileExistsW.SHLWAPI(?,775DF670), ref: 007EFAE5
PathIsDirectoryW.SHLWAPI(?), ref: 007EFAF4
lstrcpyW.KERNEL32(?,?), ref: 007EFB1E
PathRemoveFileSpecW.SHLWAPI(?), ref: 007EFB2C
SetCurrentDirectoryW.KERNEL32(?), ref: 007EFB3A
SendMessageW.USER32(00000111,00019D0D,00000000), ref: 007EFB58
SendMessageW.USER32(00001013,00000000,00000000), ref: 007EFB90
PathFileExistsW.SHLWAPI(?), ref: 007EFD97
PathIsDirectoryW.SHLWAPI(?), ref: 007EFDA6
lstrcpyW.KERNEL32(?,?), ref: 007EFDD0
PathRemoveFileSpecW.SHLWAPI(?), ref: 007EFDDA
SetCurrentDirectoryW.KERNEL32(?), ref: 007EFDE8
SendMessageW.USER32(00000111,00019D0D,00000000), ref: 007EFE06
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000200), ref: 007EFE1A
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000200), ref: 007EFB6C

Part of subcall function 007E4140: GetShortPathNameW.KERNEL32(?,?,00000104), ref: 007E41A1
Part of subcall function 007E4140: SendMessageW.USER32 ref: 007E4229
Part of subcall function 007E4140: GetShortPathNameW.KERNEL32(?,?,00000104), ref: 007E4254
Part of subcall function 007E4140: lstrcmpiW.KERNEL32(?,?), ref: 007E4266
Part of subcall function 007E4140: SendMessageW.USER32(?,00001053,00000000,?), ref: 007E427C

ExpandEnvironmentStringsW.KERNEL32(?,?,00000138,775DF670), ref: 007EFBAE
lstrcpynW.KERNEL32(?,?,00000104), ref: 007EFBCA
lstrcpyW.KERNEL32(?,?), ref: 007EFC01
GetFileAttributesW.KERNEL32(?), ref: 007EFC0B
SetCurrentDirectoryW.KERNEL32(?), ref: 007EFC26
PostMessageW.USER32(00000111,00019D0D,00000000), ref: 007EFC46
SendMessageW.USER32(00001013,00000000,00000000), ref: 007EFC5B
lstrcpyW.KERNEL32(?,?), ref: 007EFC9A
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000200), ref: 007EFCB5
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 007EFCC7
PathIsRootW.SHLWAPI(?), ref: 007EFCE1
SetCurrentDirectoryW.KERNEL32(?), ref: 007EFCF6
SendMessageW.USER32 ref: 007EFD24
SendMessageW.USER32(00001053,000000FF,00000111), ref: 007EFD38
SendMessageW.USER32(0000102B,00000000,?), ref: 007EFD62
SendMessageW.USER32(00001013,00000000,00000000), ref: 007EFD78
SendMessageW.USER32(00001013,00000000,00000000), ref: 007EFE3E

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Message$Send$Path$File$Directory$lstrcpy$Current$Info$EnvironmentExistsExpandNameRemoveShortSpecStringslstrcpyn$AttributesCreateInstancePostRootlstrcmpi
String ID:
API String ID: 622217630-0
Opcode ID: 31b5b015b5a3a96e51408ab597096b98c0a8a126ea38f2b3d76e8e5e239ed40a
Instruction ID: 83f8d153243ea971c4b588dd6b658e31fbd0746ba5b9e88b964ecd9a53362f90
Opcode Fuzzy Hash: 31b5b015b5a3a96e51408ab597096b98c0a8a126ea38f2b3d76e8e5e239ed40a
Instruction Fuzzy Hash: 07915E75644344ABE731AB61EC4AFDB77ACBB89700F040829F645D61E1E7B8E604CF92

Uniqueness

Uniqueness Score: -1.00%

Function 007EBBD0 Relevance: 47.5, APIs: 25, Strings: 2, Instructions: 208windowstringCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00001032,00000000,00000000,?), ref: 007EBBF9

Part of subcall function 007E3CE0: SendMessageW.USER32(?,00001032,00000000,00000000), ref: 007E3D18
Part of subcall function 007E3CE0: SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 007E3D28
Part of subcall function 007E3CE0: SendMessageW.USER32(?,?,?,0000104B), ref: 007E3D4D

EnableMenuItem.USER32(?,00009C44,00000000), ref: 007EBC46
EnableMenuItem.USER32(?,00009C44,00000001), ref: 007EBC58
EnableMenuItem.USER32(?,00009C45,00000001), ref: 007EBC81
EnableMenuItem.USER32(?,00009C46,00000000), ref: 007EBC91
EnableMenuItem.USER32(?,00009C4A,00000000), ref: 007EBC9A
EnableMenuItem.USER32(?,00009C4B,00000001), ref: 007EBCBA
EnableMenuItem.USER32(?,00009C4C,00000000), ref: 007EBCC3
EnableMenuItem.USER32(?,00009C4D,00000000), ref: 007EBCCC
EnableMenuItem.USER32(?,00009C50,00000000), ref: 007EBCD5
SendMessageW.USER32(00000147,00000000,00000000), ref: 007EBCE6
EnableMenuItem.USER32(?,00009C53,00000000), ref: 007EBCFB
CheckMenuItem.USER32(?,00009D0A,000000E0), ref: 007EBD15
CheckMenuItem.USER32(?,00009D0B,000000E0), ref: 007EBD29
CheckMenuItem.USER32(?,00009D0C,000000E0), ref: 007EBD3D
lstrcmpW.KERNEL32(008ED39C,*.*), ref: 007EBD49
EnableMenuItem.USER32(?,00009D11,00000000), ref: 007EBD6B
CheckMenuItem.USER32(?,00009D13,00000001), ref: 007EBD80
EnableMenuItem.USER32(?,00009D14,00000000), ref: 007EBD94
CheckMenuItem.USER32(?,00009D15,00000001), ref: 007EBDA9
CheckMenuItem.USER32(?,00009D12,00000001), ref: 007EBDBE
CheckMenuRadioItem.USER32(?,00009D6D,00009D70,-00009D6B,00000000), ref: 007EBDD8
CheckMenuItem.USER32(?,00009D71,00000000), ref: 007EBDF1
CheckMenuItem.USER32(?,0000EA61,00000000), ref: 007EBE06
EnableMenuItem.USER32(?,00009D16,00000000), ref: 007EBE2C

Strings

*.*, xrefs: 007EBD3F
C:\Users\user\Desktop\HkObDPju6Z.ini, xrefs: 007EBE12

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ItemMenu$Enable$Check$MessageSend$Radiolstrcmp
String ID: *.*$C:\Users\user\Desktop\HkObDPju6Z.ini
API String ID: 4226156974-1143585411
Opcode ID: c94100c65af99cf354e0e0a314311359ae38ed182cfa22a7822cbad079d14fcf
Instruction ID: 35d856dea3fffc59d3518340c084d43e780c3254dff9a9f67e0c613f4d8712a3
Opcode Fuzzy Hash: c94100c65af99cf354e0e0a314311359ae38ed182cfa22a7822cbad079d14fcf
Instruction Fuzzy Hash: 8E511371795795BAF320AB35DC82FBB36DCFB9A701F100011F600DA1E1DBAC99018AB9

Uniqueness

Uniqueness Score: -1.00%

Function 007E23D0 Relevance: 44.0, APIs: 23, Strings: 2, Instructions: 253windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,tooltips_class32,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,634AD31B), ref: 007E2A71
GetDlgItem.USER32(?,00000067), ref: 007E2A9F
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 007E2AC9
DestroyWindow.USER32(00000000), ref: 007E2AD0
SendMessageW.USER32(?,00000080,00000000,?), ref: 007E2AE8
SendDlgItemMessageW.USER32(?,00000066,000000C5,00000103,00000000), ref: 007E2B16
GetDlgItem.USER32(?,00000066), ref: 007E2B1D
SHAutoComplete.SHLWAPI(00000000), ref: 007E2B24
SendDlgItemMessageW.USER32(?,0000006C,000000C5,00000080,00000000), ref: 007E2B39
SendDlgItemMessageW.USER32(?,0000006D,000000C5,00000080,00000000), ref: 007E2B4A
SendDlgItemMessageW.USER32(?,0000006E,000000C5,00000080,00000000), ref: 007E2B5B
CheckRadioButton.USER32(?,00000064,00000065,00000064), ref: 007E2B7C
GetDlgItem.USER32(?,00000067), ref: 007E2CB2
SendMessageW.USER32(00000000,00001603,00000000,?), ref: 007E2CC4
ImageList_Destroy.COMCTL32(?), ref: 007E2CD1

Strings

tooltips_class32, xrefs: 007E2A6A
0, xrefs: 007E2A8B

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ItemMessageSend$DestroyWindow$AutoButtonCheckCompleteCreateImageList_Radio
String ID: 0$tooltips_class32
API String ID: 2672803554-3619404913
Opcode ID: 1b41e314cf56792a04484fce900f7db3bb5816eb5ab91afb55a2df47407c6209
Instruction ID: a2e890d1daf53558214cc1bfe40a8686367b78af394c1fda60bd4417f1898e24
Opcode Fuzzy Hash: 1b41e314cf56792a04484fce900f7db3bb5816eb5ab91afb55a2df47407c6209
Instruction Fuzzy Hash: 6681C371B40344ABE7219F61DC49F7A77B9FB49B00F104129F601EB2E0EBB99841CB64

Uniqueness

Uniqueness Score: -1.00%

Function 007E3320 Relevance: 42.4, APIs: 20, Strings: 4, Instructions: 386windowstringmemoryCOMMON

Download Yara Rule

APIs

GetPropW.USER32(00000000,DirListData), ref: 007E33AC
SHGetFileInfoW.SHELL32(Icon,00000010,?,000002B4,00004011), ref: 007E33D5
SHGetFileInfoW.SHELL32(Icon,00000080,?,000002B4,00004011), ref: 007E3404

Part of subcall function 007E3280: GetPropW.USER32(?,DirListData), ref: 007E328A
Part of subcall function 007E3280: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,007E3420,?,?), ref: 007E3298
Part of subcall function 007E3280: WaitForSingleObject.KERNEL32(?,00000000,?,?,?,?,?,?,?,007E3420,?,?), ref: 007E32A6
Part of subcall function 007E3280: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007E32D2
Part of subcall function 007E3280: TranslateMessage.USER32(?), ref: 007E32DD
Part of subcall function 007E3280: DispatchMessageW.USER32(?), ref: 007E32E4
Part of subcall function 007E3280: WaitForSingleObject.KERNEL32(?,00000000,?,?,?,?,?,?,?,007E3420,?,?), ref: 007E32EE
Part of subcall function 007E3280: ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,007E3420,?,?), ref: 007E3301
Part of subcall function 007E3280: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,007E3420,?,?), ref: 007E330D

lstrcpyW.KERNEL32(?,C:\Users\user\Desktop), ref: 007E3437
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 007E3448
SendMessageW.USER32(?,00001009,00000000,00000000), ref: 007E3458
lstrcmpW.KERNEL32(?,*.*,?,?,?,?,?,?), ref: 007E34CA
StrChrW.SHLWAPI ref: 007E34F3
StrChrW.SHLWAPI(?,0000003B), ref: 007E3520
lstrcpyW.KERNEL32(?,C:\Users\user\Desktop), ref: 007E356C
SHGetDesktopFolder.SHELL32(?,?,?,?,?,?,?,?,?), ref: 007E3577
SHGetDataFromIDListW.SHELL32(?,?,00000001,?,00000250), ref: 007E367F
PathMatchSpecW.SHLWAPI(?,?), ref: 007E36C6
CoTaskMemAlloc.OLE32(00000008), ref: 007E36E9
SendMessageW.USER32(?,0000104D,00000000,?), ref: 007E3747
CoTaskMemFree.OLE32(?,?,?,?,?,?,?,?,?), ref: 007E3792
SendMessageW.USER32(?,0000101E,00000000,0000FFFE), ref: 007E37FF
SendMessageW.USER32(?,00001030,00000000,007E3C30), ref: 007E3824
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 007E382D
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 007E3839

Strings

*.*, xrefs: 007E34C4
DirListData, xrefs: 007E33A6
C:\Users\user\Desktop, xrefs: 007E3432, 007E3533
Icon, xrefs: 007E33D0, 007E33FF

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Message$Send$Event$FileInfoObjectPropSingleTaskWaitlstrcpy$AllocDataDesktopDispatchFolderFreeFromListMatchPathPeekResetSpecTranslatelstrcmp
String ID: *.*$C:\Users\user\Desktop$DirListData$Icon
API String ID: 2929906256-3719017697
Opcode ID: 3958559d41ed66b70a7fc7f7a44f916eb09bbc5231f63f9e7d306d10d37a27b2
Instruction ID: 3ec15cc85642da1b964457a00608b1c033fde8722298354f5819b2a88be511ba
Opcode Fuzzy Hash: 3958559d41ed66b70a7fc7f7a44f916eb09bbc5231f63f9e7d306d10d37a27b2
Instruction Fuzzy Hash: E5E17DB0205381AFE720CF65C888F6BB7E4BF88704F14491DF6999B290D775EA05CB52

Uniqueness

Uniqueness Score: -1.00%

Function 007E0EB0 Relevance: 42.2, APIs: 23, Strings: 1, Instructions: 237stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007E3CE0: SendMessageW.USER32(?,00001032,00000000,00000000), ref: 007E3D18
Part of subcall function 007E3CE0: SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 007E3D28
Part of subcall function 007E3CE0: SendMessageW.USER32(?,?,?,0000104B), ref: 007E3D4D

Part of subcall function 007E64F0: lstrlenW.KERNEL32(?,?,?,007DE260), ref: 007E64F5
Part of subcall function 007E64F0: CharPrevW.USER32(?,?,?,?,007DE260), ref: 007E6512
Part of subcall function 007E64F0: CharPrevW.USER32(?,?,?,?,?,007DE260), ref: 007E651C

lstrcpyW.KERNEL32(?,00000000), ref: 007E0F1B

Part of subcall function 007E7A20: FindResourceW.KERNEL32(00000000,?,00000005,?,?), ref: 007E7A37
Part of subcall function 007E7A20: LoadResource.KERNEL32(00000000,00000000), ref: 007E7A4A
Part of subcall function 007E7A20: LockResource.KERNEL32(00000000), ref: 007E7A5B
Part of subcall function 007E7A20: SizeofResource.KERNEL32(00000000,00000000), ref: 007E7A6E
Part of subcall function 007E7A20: LocalAlloc.KERNEL32(00000040,00000040), ref: 007E7A84
Part of subcall function 007E7A20: FreeResource.KERNEL32(00000000), ref: 007E7AA0
Part of subcall function 007E7A20: lstrlenW.KERNEL32(?), ref: 007E7B1D

DialogBoxIndirectParamW.USER32(?,00000000,?,Function_00010610,?), ref: 007E0F3C
LocalFree.KERNEL32(00000000,?,Function_00010610,?), ref: 007E0F49
LocalAlloc.KERNEL32(00000040,00000268), ref: 007E0FCC
lstrcpynW.KERNEL32(00000000,Copy/Move MRU,00000100,?,Function_00010610,?), ref: 007E0FFD
lstrcmpiW.KERNEL32(00000000,00000000), ref: 007E1044
lstrcmpW.KERNEL32(00000000,00000000), ref: 007E104C
LocalFree.KERNEL32(?), ref: 007E106B
StrDupW.SHLWAPI(00000000), ref: 007E10A6
ExpandEnvironmentStringsW.KERNEL32(?,?,00000138), ref: 007E10E1
lstrcpynW.KERNEL32(?,?,00000104), ref: 007E1100
lstrcpyW.KERNEL32(?,?), ref: 007E1140
lstrcpyW.KERNEL32(?,?), ref: 007E1152
PathIsRelativeW.SHLWAPI(?,?,?,?,?,Function_00010610,?), ref: 007E115C
GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,Function_00010610,?), ref: 007E1179
PathAppendW.SHLWAPI(?,?,?,?,?,?,Function_00010610,?), ref: 007E118F
lstrcpyW.KERNEL32(?,?), ref: 007E11A1
PathIsDirectoryW.SHLWAPI(?), ref: 007E11AB
PathFindFileNameW.SHLWAPI(?,?,?,?,?,Function_00010610,?), ref: 007E11BD
PathAppendW.SHLWAPI(?,00000000,?,?,?,?,Function_00010610,?), ref: 007E11CC
SHFileOperationW.SHELL32(?,?,?,?,?,Function_00010610,?), ref: 007E11D3
GetFileAttributesW.KERNEL32(?,?,?,?,?,Function_00010610,?), ref: 007E11ED
SetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,Function_00010610,?), ref: 007E1203

Strings

Copy/Move MRU, xrefs: 007E0FF7

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: PathResource$FileLocallstrcpy$FreeMessageSend$AllocAppendAttributesCharDirectoryFindPrevlstrcpynlstrlen$CurrentDialogEnvironmentExpandIndirectLoadLockNameOperationParamRelativeSizeofStringslstrcmplstrcmpi
String ID: Copy/Move MRU
API String ID: 3598563394-4109381532
Opcode ID: bac8671f71131e3145ad5e19300de5cc6476a5c35e966e7de187524f5c17b313
Instruction ID: d028adf9d46c1124cafb9a85f08575eb2c3f49db540b4f0a6eeece06d9083b1f
Opcode Fuzzy Hash: bac8671f71131e3145ad5e19300de5cc6476a5c35e966e7de187524f5c17b313
Instruction Fuzzy Hash: C791B276604385DBD720DF61DC89BABB7ECFF88300F404919E699D3291EB78A544CB92

Uniqueness

Uniqueness Score: -1.00%

Function 007DEC50 Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 170windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000080,00000000,?), ref: 007DEC81
CheckDlgButton.USER32(?,0000006B,00000001), ref: 007DECA5
GetDlgItem.USER32(?,0000006B), ref: 007DECAE
EnableWindow.USER32(00000000), ref: 007DECB5
CheckDlgButton.USER32(?,00000064,00000001), ref: 007DECC9
CheckDlgButton.USER32(?,00000065,00000001), ref: 007DECD9
CheckDlgButton.USER32(?,00000066,00000001), ref: 007DECE9
CheckDlgButton.USER32(?,00000067,00000001), ref: 007DECF9
CheckDlgButton.USER32(?,00000068,00000001), ref: 007DED09
CheckDlgButton.USER32(?,00000069,00000001), ref: 007DED19
CheckDlgButton.USER32(?,0000006A,00000001), ref: 007DED3C
GetDlgItem.USER32(?,0000006B), ref: 007DED65
IsWindowEnabled.USER32(00000000), ref: 007DED6C
IsDlgButtonChecked.USER32(?,0000006B), ref: 007DED7F
IsDlgButtonChecked.USER32(?,00000064), ref: 007DED8F
IsDlgButtonChecked.USER32(?,00000065), ref: 007DED9F
IsDlgButtonChecked.USER32(?,00000066), ref: 007DEDAF
IsDlgButtonChecked.USER32(?,00000067), ref: 007DEDBF
IsDlgButtonChecked.USER32(?,00000068), ref: 007DEDCF
IsDlgButtonChecked.USER32(?,00000069), ref: 007DEDDF
IsDlgButtonChecked.USER32(?,0000006A), ref: 007DEDEF
SetWindowLongW.USER32(?,00000000,00000000), ref: 007DEE06

Strings

Settings2, xrefs: 007DED22
ReuseWindow, xrefs: 007DED1D

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Button$CheckChecked$Window$Item$EnableEnabledLongMessageSend
String ID: ReuseWindow$Settings2
API String ID: 803896276-719659277
Opcode ID: 5ec15432475535d1a6c17dc4c4aafd1e930f738e3535c9c61a57aa47fdd3949d
Instruction ID: 2498b1ce1f5a055d518c9ec0181a0058e3ebd75fea1cc16d8c7e9fabab2c5547
Opcode Fuzzy Hash: 5ec15432475535d1a6c17dc4c4aafd1e930f738e3535c9c61a57aa47fdd3949d
Instruction Fuzzy Hash: A341FB71391746AAF7317B34EC49FBB3269BB41B01F010626F601EE1E0DBFA8941CA64

Uniqueness

Uniqueness Score: -1.00%

Function 007DFB10 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 173windowstringCOMMON

Download Yara Rule

APIs

Part of subcall function 007E7A20: FindResourceW.KERNEL32(00000000,?,00000005,?,?), ref: 007E7A37
Part of subcall function 007E7A20: LoadResource.KERNEL32(00000000,00000000), ref: 007E7A4A
Part of subcall function 007E7A20: LockResource.KERNEL32(00000000), ref: 007E7A5B
Part of subcall function 007E7A20: SizeofResource.KERNEL32(00000000,00000000), ref: 007E7A6E
Part of subcall function 007E7A20: LocalAlloc.KERNEL32(00000040,00000040), ref: 007E7A84
Part of subcall function 007E7A20: FreeResource.KERNEL32(00000000), ref: 007E7AA0
Part of subcall function 007E7A20: lstrlenW.KERNEL32(?), ref: 007E7B1D

PropertySheetW.COMCTL32(?,?,?,?,?), ref: 007DFC75
LocalFree.KERNEL32(?,?,?,?,?,?), ref: 007DFC8C
LocalFree.KERNEL32(?,?,?,?,?,?), ref: 007DFC9A
LocalFree.KERNEL32(?,?,?,?,?,?), ref: 007DFCA8
LocalFree.KERNEL32(?,?,?,?,?,?), ref: 007DFCB6
SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000003,?,?,?,?,?), ref: 007DFCDA
SendMessageW.USER32(00001036,00000048,00000000), ref: 007DFD02
SendMessageW.USER32(00001036,00000020,00000020), ref: 007DFD1C
SendMessageW.USER32(00001036,00000020,00000000), ref: 007DFD36
lstrcmpW.KERNEL32(008ED39C,*.*,?,000000FE,00000000,00000000,00000000,00000000,00000003,?,?,?,?,?), ref: 007DFD55
GetSysColor.USER32(00000012), ref: 007DFD9A

Part of subcall function 007D19E0: SystemParametersInfoW.USER32(00000042,0000000C,00000000), ref: 007D1A11

SendMessageW.USER32(00001024,00000000,00D77800), ref: 007DFDB5
SendMessageW.USER32(00001004,00000000,00000000), ref: 007DFDC6
SendMessageW.USER32(00001015,00000000,-00000001), ref: 007DFDD7

Strings

MiniPath, xrefs: 007DFC5D
Explorer, xrefs: 007DFD20
*.*, xrefs: 007DFD4B
Listview, xrefs: 007DFD3A
8, xrefs: 007DFBA7
4, xrefs: 007DFC41
8, xrefs: 007DFBE4
8, xrefs: 007DFB3D
8, xrefs: 007DFB70

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MessageSend$FreeLocalResource$AllocColorFindInfoLoadLockParametersPropertySheetSizeofSystemWindowlstrcmplstrlen
String ID: *.*$4$8$8$8$8$Explorer$Listview$MiniPath
API String ID: 2619407685-1146650878
Opcode ID: 8b0d112836a5a422b049c79082a81ac390938b681e0834a5dc11dbc316bb7bcb
Instruction ID: 3af9a130f08f24f6cc11e4912c47825a35b1ab48acfa619d530932d70d4d26e0
Opcode Fuzzy Hash: 8b0d112836a5a422b049c79082a81ac390938b681e0834a5dc11dbc316bb7bcb
Instruction Fuzzy Hash: 74619F70608381ABE3309F20DC49B5B7BF5BB84704F14492EF689AA3E0D7B99844CF52

Uniqueness

Uniqueness Score: -1.00%

Function 007E5CA0 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 148stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 007E5CE5
PathRemoveFileSpecW.SHLWAPI(?), ref: 007E5CF3
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 007E5D06
SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?), ref: 007E5D19
PathIsRelativeW.SHLWAPI(C:\Windows\system32\Viewers\Quikview.exe), ref: 007E5D2E
PathIsPrefixW.SHLWAPI(?,?), ref: 007E5D4B
PathIsPrefixW.SHLWAPI(?,C:\Windows\system32\Viewers\Quikview.exe), ref: 007E5D57
PathRelativePathToW.SHLWAPI(?,?,00000010,C:\Windows\system32\Viewers\Quikview.exe,?), ref: 007E5D72
lstrcpyW.KERNEL32(?,%CSIDL:MYDOCUMENTS%), ref: 007E5D8C
PathAppendW.SHLWAPI(?,?), ref: 007E5D9B
lstrcpyW.KERNEL32(?,?), ref: 007E5DAE
PathIsRelativeW.SHLWAPI(C:\Windows\system32\Viewers\Quikview.exe), ref: 007E5DB7
PathCommonPrefixW.SHLWAPI(?,?,00000000), ref: 007E5DD2
PathRelativePathToW.SHLWAPI(?,?,00000010,C:\Windows\system32\Viewers\Quikview.exe,?), ref: 007E5DF0
lstrcpynW.KERNEL32(?,C:\Windows\system32\Viewers\Quikview.exe,00000104), ref: 007E5E08
PathUnExpandEnvStringsW.SHLWAPI(?,?,00000104), ref: 007E5E1F
lstrcpynW.KERNEL32(?,?,00000104), ref: 007E5E3E
lstrcpynW.KERNEL32(C:\Windows\system32\Viewers\Quikview.exe,?,00000104), ref: 007E5E66

Strings

C:\Windows\system32\Viewers\Quikview.exe, xrefs: 007E5D2D, 007E5D51, 007E5D62, 007E5DB6, 007E5DDD, 007E5DFF, 007E5E65
%CSIDL:MYDOCUMENTS%, xrefs: 007E5D86

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Path$Relative$Prefixlstrcpyn$Filelstrcpy$AppendCommonDirectoryExpandFolderModuleNameRemoveSpecStringsWindows
String ID: %CSIDL:MYDOCUMENTS%$C:\Windows\system32\Viewers\Quikview.exe
API String ID: 3942253345-3867429074
Opcode ID: 510b53fd74b7605d0344be51a62d8978844b2bf0d507b16f5edaf892e1263504
Instruction ID: 5d97123a357f23b0264f1631c37dc05d7ed903b29dac9686f6c4bd4a97805b74
Opcode Fuzzy Hash: 510b53fd74b7605d0344be51a62d8978844b2bf0d507b16f5edaf892e1263504
Instruction Fuzzy Hash: DB512172605349ABD730DFA1DC88FEB77ECBB89705F04082AB645D7150E674E548CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 007ECE72 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 103stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 007ECE81
lstrcpyW.KERNEL32(?,008EBF0C), ref: 007ECE94
PathQuoteSpacesW.SHLWAPI(?), ref: 007ECEA2
lstrcatW.KERNEL32(?, -f), ref: 007ECEBB
lstrcatW.KERNEL32(?,0085DF90), ref: 007ECED4
lstrcatW.KERNEL32(?,008E8DE8), ref: 007ECEE3
lstrcatW.KERNEL32(?,0085E6B0), ref: 007ECEF9
lstrcatW.KERNEL32(?, -n), ref: 007ECF08
GetWindowPlacement.USER32(?,?), ref: 007ECF1E
MonitorFromRect.USER32(?,00000002), ref: 007ECF2E
GetMonitorInfoW.USER32(00000000,?), ref: 007ECF42
wsprintfW.USER32 ref: 007ECFA1
lstrcatW.KERNEL32(?,?), ref: 007ECFBA
ShellExecuteW.SHELL32(?,00000000,?,?,00000000,00000001), ref: 007ECFD3

Strings

(, xrefs: 007ECF38
-n, xrefs: 007ECEFB
-p %i,%i,%i,%i, xrefs: 007ECF9B
-f, xrefs: 007ECEB5
,, xrefs: 007ECF11

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: lstrcat$Monitor$ExecuteFileFromInfoModuleNamePathPlacementQuoteRectShellSpacesWindowlstrcpywsprintf
String ID: -f$ -n$ -p %i,%i,%i,%i$($,
API String ID: 3816053248-2039397706
Opcode ID: f4d18ee9927be2e77236bc61de38e3ee81601809fb19fd4bfbe61c43e9ce5137
Instruction ID: 5b36b3b0fe4b81873794a096ed4014274145abbc37f271e6ea054758f48c822c
Opcode Fuzzy Hash: f4d18ee9927be2e77236bc61de38e3ee81601809fb19fd4bfbe61c43e9ce5137
Instruction Fuzzy Hash: 57413E765083859FE630DB60CC89E9BBBECFB85301F40481AF599D3291DB74A549CB92

Uniqueness

Uniqueness Score: -1.00%

Function 007E5E90 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 114stringCOMMON

Download Yara Rule

APIs

StrCmpNIW.SHLWAPI(C:\Users\user\Documents,%CSIDL:MYDOCUMENTS%,00000013,?,00000002), ref: 007E5EB3
SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?,?,00000002), ref: 007E5ED3
PathAppendW.SHLWAPI(?,?,?,00000002), ref: 007E5EE5
lstrcpynW.KERNEL32(?,C:\Users\user\Documents,00000104,?,00000002), ref: 007E5EF4
ExpandEnvironmentStringsW.KERNEL32(?,?,00000138,?,00000002), ref: 007E5F0B
lstrcpynW.KERNEL32(?,?,00000104,?,00000002), ref: 007E5F2A
PathIsRelativeW.SHLWAPI(?,?,00000002), ref: 007E5F34
GetModuleFileNameW.KERNEL32(00000000,00000104,00000104,?,00000002), ref: 007E5F4A
PathRemoveFileSpecW.SHLWAPI(?,?,00000002), ref: 007E5F55
PathAppendW.SHLWAPI(?,?,?,00000002), ref: 007E5F68
lstrcpynW.KERNEL32(?,?,00000104,?,00000002), ref: 007E5F7D
PathCanonicalizeW.SHLWAPI(?,?,?,00000002), ref: 007E5F8C
lstrcpyW.KERNEL32(?,?), ref: 007E5FA3
PathGetDriveNumberW.SHLWAPI(?,?,00000002), ref: 007E5FAE
CharUpperBuffW.USER32(00000001,00000001,?,00000002), ref: 007E5FC0
lstrcpynW.KERNEL32(C:\Users\user\Documents,00000104,00000104,?,00000002), ref: 007E5FE6

Strings

%CSIDL:MYDOCUMENTS%, xrefs: 007E5EAD
C:\Users\user\Documents, xrefs: 007E5EB2, 007E5EF2, 007E5FE5

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Path$lstrcpyn$AppendFile$BuffCanonicalizeCharDriveEnvironmentExpandFolderModuleNameNumberRelativeRemoveSpecStringsUpperlstrcpy
String ID: %CSIDL:MYDOCUMENTS%$C:\Users\user\Documents
API String ID: 1371384388-1289764784
Opcode ID: 99f962b6b85ee1e5db891fcdea820888a3edcbbb3200c3a0542d08d1dff220b1
Instruction ID: ba6c7bb0424b5f636d33c8316f4f5fdf3dbb339b221791801681b013b5bef3aa
Opcode Fuzzy Hash: 99f962b6b85ee1e5db891fcdea820888a3edcbbb3200c3a0542d08d1dff220b1
Instruction Fuzzy Hash: BD413EB6644349ABD720DFA1DC89FEB77ECBB88705F00492AB255C3090EB74D508CB62

Uniqueness

Uniqueness Score: -1.00%

Function 007D3F80 Relevance: 29.8, APIs: 14, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 007D3FDB
GetSysColor.USER32(00000005), ref: 007D3FE4
GetSysColor.USER32(00000017), ref: 007D3FED
GetSysColor.USER32(00000018), ref: 007D3FF6
GetSysColor.USER32(0000000E), ref: 007D3FFF
GetSysColor.USER32(0000000D), ref: 007D4008
GetSysColor.USER32(00000002), ref: 007D4011
GetSysColor.USER32(00000001), ref: 007D401A
GetSysColor.USER32(0000000F), ref: 007D4023
GetSysColor.USER32(0000000F), ref: 007D402C
GetSysColor.USER32(0000000F), ref: 007D4035
GetSysColor.USER32(0000000F), ref: 007D403E
GetSysColor.USER32(0000000F), ref: 007D4047
GetSysColor.USER32(0000000F), ref: 007D4050

Strings

1 2 3 4 5 0 8, xrefs: 007D3FAD
*.*, xrefs: 007D3FC5
%USERPROFILE%\Desktop, xrefs: 007D3FA7

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Color
String ID: %USERPROFILE%\Desktop$*.*$1 2 3 4 5 0 8
API String ID: 2811717613-2379977711
Opcode ID: 2551c63f4be7935aa4fb9c26ee6ef5b3dedf71c639335b759f3a88eee28a1fde
Instruction ID: 901aa719a822ed0d0636f88f66b0d5e46392e4ae8a41338c3b283626fbba0ba0
Opcode Fuzzy Hash: 2551c63f4be7935aa4fb9c26ee6ef5b3dedf71c639335b759f3a88eee28a1fde
Instruction Fuzzy Hash: 68218564D513E49AD728DFB1AD897163FB0FB18B50F01552BD1888F2B0EBB96080DF46

Uniqueness

Uniqueness Score: -1.00%

Function 007E76A0 Relevance: 26.5, APIs: 9, Strings: 6, Instructions: 218COMMON

Download Yara Rule

APIs

Part of subcall function 007E8460: ResolveLocaleName.KERNEL32(008E8FF0,?,00000055), ref: 007E848A
Part of subcall function 007E8460: GetLocaleInfoEx.KERNEL32(?,20000001,00000002), ref: 007E84AD

GetDC.USER32 ref: 007E7752
EnumFontsW.GDI32(00000000,Segoe UI,007E7510,00000000), ref: 007E7766
ReleaseDC.USER32(00000000,00000000), ref: 007E776F
GetDC.USER32(00000000), ref: 007E77B2
GetDeviceCaps.GDI32(00000000,0000005A), ref: 007E77BD
ReleaseDC.USER32(00000000,00000000), ref: 007E77CA
MulDiv.KERNEL32(?,00000048,00000000), ref: 007E781E
SystemParametersInfoW.USER32(00000029,000001F8,000001F4,00000000), ref: 007E78DC
MulDiv.KERNEL32(?,00000048,?), ref: 007E78FD

Strings

Segoe UI, xrefs: 007E7737
Microsoft JhengHei UI, xrefs: 007E7702, 007E7718, 007E7764
Microsoft YaHei UI, xrefs: 007E7709, 007E771F
Malgun Gothic, xrefs: 007E7730
Yu Gothic UI, xrefs: 007E7729
WINDOWSTYLE;WINDOW, xrefs: 007E77DC

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: InfoLocaleRelease$CapsDeviceEnumFontsNameParametersResolveSystem
String ID: Malgun Gothic$Microsoft JhengHei UI$Microsoft YaHei UI$Segoe UI$WINDOWSTYLE;WINDOW$Yu Gothic UI
API String ID: 1673905233-1160875775
Opcode ID: 41ed4526c825c7ff1eaaca06b070c61ede369f77c66e132196580b2fed6c3344
Instruction ID: 35db8eb727a6897a63cc9aef415a9b8535a9bcfc37740a7b1d287db6ab4a6753
Opcode Fuzzy Hash: 41ed4526c825c7ff1eaaca06b070c61ede369f77c66e132196580b2fed6c3344
Instruction Fuzzy Hash: 697102356093819BE7288F66CC88B7A73E5FF89711F04492DED55CB290EB39C908C792

Uniqueness

Uniqueness Score: -1.00%

Function 007E54F0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 103stringCOMMON

Download Yara Rule

APIs

PathIsRootW.SHLWAPI ref: 007E5534
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000200), ref: 007E5568
PathFindFileNameW.SHLWAPI(?,?,00000000,?,000002B4,00000200), ref: 007E5579
lstrcpyW.KERNEL32(?,00000000), ref: 007E558E
lstrcpyW.KERNEL32(?), ref: 007E55B0
PathRemoveFileSpecW.SHLWAPI(?,?,?,000002B4,00000200), ref: 007E55BA
lstrcatW.KERNEL32(?, - [), ref: 007E55D3
lstrcatW.KERNEL32(?,?), ref: 007E55E5
lstrlenW.KERNEL32(?), ref: 007E55FB
lstrcatW.KERNEL32(?,0085E27C), ref: 007E5619
lstrcatW.KERNEL32(?,0085E280), ref: 007E562A
lstrcpyW.KERNEL32(?), ref: 007E5637
SetWindowTextW.USER32(?,?), ref: 007E5646

Strings

\, xrefs: 007E5601
- [, xrefs: 007E55CD

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: lstrcat$FilePathlstrcpy$FindInfoNameRemoveRootSpecTextWindowlstrlen
String ID: - [$\
API String ID: 572060143-3704741174
Opcode ID: 7d36f8ee9833e5a17cfd9f1a2f1d42124ea4afc712947c75dcc8049d0b71d2cc
Instruction ID: 362241df35c522d845a941e60f49f5bd51964760ff011c4e393035cf56b8f086
Opcode Fuzzy Hash: 7d36f8ee9833e5a17cfd9f1a2f1d42124ea4afc712947c75dcc8049d0b71d2cc
Instruction Fuzzy Hash: B13163B5906748AAE770DB60DC49FDFB7ECBB88704F400829F649D3181E7789548CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 007F0270 Relevance: 25.6, APIs: 6, Strings: 11, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007D2810: PathFileExistsW.SHLWAPI(008E8DE8,?,?,007D4A32,634AD31B), ref: 007D2827
Part of subcall function 007D2810: PathIsDirectoryW.SHLWAPI(008E8DE8), ref: 007D283A

lstrcpyW.KERNEL32(008E96C0,Notepad3.exe), ref: 007F041A
lstrcpyW.KERNEL32(008E98D0,0085D420), ref: 007F0426
lstrcpyW.KERNEL32(008E92B0,Notepad3), ref: 007F0432
lstrcpyW.KERNEL32(008E9AE0,0085D420), ref: 007F043E
lstrcpyW.KERNEL32(008E90A0,0085D420), ref: 007F044A
lstrcpyW.KERNEL32(008E94C0,0085D420), ref: 007F0456

Part of subcall function 007D29E0: lstrlenW.KERNEL32(?,?,?,?,?,0085D420,008E8FF0,00000055,634AD31B), ref: 007D2ABC

Strings

TargetApplicationPath, xrefs: 007F0324
TargetApplicationMode, xrefs: 007F02FE
UseTargetApplication, xrefs: 007F02BE, 007F02E1
Notepad3.exe, xrefs: 007F040A
TargetApplicationWndClass, xrefs: 007F0366
Target Application, xrefs: 007F02C3, 007F02E6, 007F0303, 007F0329, 007F034A, 007F036B, 007F038C, 007F03AD, 007F03CE
DDEApplication, xrefs: 007F03A8
DDETopic, xrefs: 007F03C9
Notepad3, xrefs: 007F0428
DDEMessage, xrefs: 007F0387
TargetApplicationParams, xrefs: 007F0345

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: lstrcpy$Path$DirectoryExistsFilelstrlen
String ID: DDEApplication$DDEMessage$DDETopic$Notepad3$Notepad3.exe$Target Application$TargetApplicationMode$TargetApplicationParams$TargetApplicationPath$TargetApplicationWndClass$UseTargetApplication
API String ID: 3318512330-1779093258
Opcode ID: 0815b9f331258bab48b7abe10868ca4227bdf943d64d9e3c8cbbd758317ad667
Instruction ID: 2619f5bc0406bee1b7ad5d99ac71adae2d4e7f9f7ed9ebc3a529b70c9673e976
Opcode Fuzzy Hash: 0815b9f331258bab48b7abe10868ca4227bdf943d64d9e3c8cbbd758317ad667
Instruction Fuzzy Hash: FC4115B0780784B7DB185B916C47B2B3A60F702B55F100436FF61EA3D2E9F9664DC291

Uniqueness

Uniqueness Score: -1.00%

Function 007E4510 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 201windowmemoryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 007E453B
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 007E4547
SHGetSpecialFolderLocation.SHELL32(?,00000011,?), ref: 007E457E
SHGetDesktopFolder.SHELL32(?), ref: 007E4591
SHGetDataFromIDListW.SHELL32(00000000,00000000,00000003,?,00000014), ref: 007E4643
CoTaskMemAlloc.OLE32(00000008), ref: 007E465F
SendMessageW.USER32(?,0000040D,00000000,?), ref: 007E46A1
SendMessageW.USER32(?,0000040D,00000000,00000020), ref: 007E46D2
SendMessageW.USER32(?,0000040B,00000000,?), ref: 007E46F1
CoTaskMemFree.OLE32(?), ref: 007E472E
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 007E4747
SendMessageW.USER32(?,00000146,00000000,00000000), ref: 007E4753

Strings

, xrefs: 007E4688
', xrefs: 007E4571

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MessageSend$FolderTask$AllocDataDesktopFreeFromListLocationSpecial
String ID: $'
API String ID: 202417901-2481900351
Opcode ID: 4b45b9550fd7251e1322a1c8e335c1b55e7f5eed1ee68ce3aa1850e185003317
Instruction ID: 1d35a2e7e63491d42e761b42ecb705963e57691b75ead9e4ecb7c3caabe6ffd8
Opcode Fuzzy Hash: 4b45b9550fd7251e1322a1c8e335c1b55e7f5eed1ee68ce3aa1850e185003317
Instruction Fuzzy Hash: 0C71F471204342AFE210CF59CC81F6AB7E8BF89B04F10491CF694DB2A0DBB5E945CB56

Uniqueness

Uniqueness Score: -1.00%

Function 007DDF6B Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 152stringwindowCOMMON

Download Yara Rule

APIs

GetDlgItemTextW.USER32(?,00000064,?,00000104), ref: 007DDF7B
EndDialog.USER32(?,00000001), ref: 007DDF9B
StrChrW.SHLWAPI(?,00000020,?,00000001), ref: 007DE005
lstrcpyW.KERNEL32(?,-00000002), ref: 007DE020
lstrcpyW.KERNEL32(?,?), ref: 007DDFB7

Part of subcall function 007E6380: CharNextW.USER32(?,?,775DF670,?,007DF938), ref: 007E63A1
Part of subcall function 007E6380: lstrlenW.KERNEL32(?,?,775DF670,?,007DF938), ref: 007E63B2
Part of subcall function 007E6380: lstrlenW.KERNEL32(?,?,?,007DF938), ref: 007E63C7
Part of subcall function 007E6380: CharPrevW.USER32(?,00000000,?,?,007DF938), ref: 007E63D4
Part of subcall function 007E6380: CharPrevW.USER32(?,00000000,?,?,007DF938), ref: 007E63E7

lstrcpyW.KERNEL32(0000002F,0000002F), ref: 007DE084
StrChrW.SHLWAPI(?,00000020), ref: 007DE0D2
lstrcpyW.KERNEL32(?,-00000002), ref: 007DE0ED
ShellExecuteExW.SHELL32(?), ref: 007DE18E
GetDlgItem.USER32(?,00000064), ref: 007DE19D
PostMessageW.USER32(?,00000028,00000000), ref: 007DE1A7

Strings

<, xrefs: 007DE154
", xrefs: 007DE0A0

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: lstrcpy$Char$ItemPrevlstrlen$DialogExecuteMessageNextPostShellText
String ID: "$<
API String ID: 2186483312-437245629
Opcode ID: beb136eaa0921bccac4ff655ed013d01a8568b3174e4a344f7b0c052e2c18ade
Instruction ID: 026fdf51c4e92ab5f4341a6cfcfc7a6ee2521ab0aa3781c92f7b2bde2718633d
Opcode Fuzzy Hash: beb136eaa0921bccac4ff655ed013d01a8568b3174e4a344f7b0c052e2c18ade
Instruction Fuzzy Hash: 3F5120B16043859AD770EB60D885BEFB3E8FF95710F00492FE68997281EF745448CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 007E244D Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 146stringwindowCOMMON

Download Yara Rule

APIs

GetDlgItemTextW.USER32(?,00000066,?,00000104), ref: 007E246F
lstrcpyW.KERNEL32(?,?), ref: 007E248B

Part of subcall function 007E6380: CharNextW.USER32(?,?,775DF670,?,007DF938), ref: 007E63A1
Part of subcall function 007E6380: lstrlenW.KERNEL32(?,?,775DF670,?,007DF938), ref: 007E63B2
Part of subcall function 007E6380: lstrlenW.KERNEL32(?,?,?,007DF938), ref: 007E63C7
Part of subcall function 007E6380: CharPrevW.USER32(?,00000000,?,?,007DF938), ref: 007E63D4
Part of subcall function 007E6380: CharPrevW.USER32(?,00000000,?,?,007DF938), ref: 007E63E7

StrChrW.SHLWAPI(00000022,00000020), ref: 007E24DC
lstrcpyW.KERNEL32(?,-00000002), ref: 007E24F6
GetOpenFileNameW.COMDLG32(00000058), ref: 007E259F
StrCpyNW.SHLWAPI(?,?,00000104), ref: 007E25C0
PathQuoteSpacesW.SHLWAPI(?), ref: 007E25E3
StrCatBuffW.SHLWAPI(?,0085DDEC,00000104), ref: 007E2610
StrCatBuffW.SHLWAPI(?,?,00000104), ref: 007E2625
SetDlgItemTextW.USER32(?,00000066,?), ref: 007E2631
PostMessageW.USER32(?,00000028,00000001,00000000), ref: 007E263E
CheckRadioButton.USER32(?,00000064,00000065,00000065), ref: 007E264B

Strings

X, xrefs: 007E2553
", xrefs: 007E24A5

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Char$BuffItemPrevTextlstrcpylstrlen$ButtonCheckFileMessageNameNextOpenPathPostQuoteRadioSpaces
String ID: "$X
API String ID: 1396828129-1355838460
Opcode ID: 4ec2840fac809d6ca7105c76fca3a8ee30cc4be9094bfb004e058d4e55a64360
Instruction ID: 41090548f231073e578c832101e8b46138e9ee03b71a779ad1b0e0ffdd117276
Opcode Fuzzy Hash: 4ec2840fac809d6ca7105c76fca3a8ee30cc4be9094bfb004e058d4e55a64360
Instruction Fuzzy Hash: AB51BFB1905328DBEB60DB60DC89BDE73B8FB08700F0041A6E649E7191EF759A84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 007EB8D0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000FA), ref: 007EB8F3
GetWindowLongW.USER32(000000EC), ref: 007EB92C
SetWindowLongW.USER32(000000EC,00000000), ref: 007EB93C
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000027,?,000000FA), ref: 007EB954
SendMessageW.USER32(0000031A,00000000,00000000), ref: 007EB96F
SendMessageW.USER32(0000040D,00000000,?), ref: 007EB997
DestroyWindow.USER32 ref: 007EB9B3
DestroyWindow.USER32 ref: 007EB9BB
DestroyWindow.USER32 ref: 007EB9C3
GetClientRect.USER32(?,?), ref: 007EB9D4
SendMessageW.USER32(?,00000005,00000000,?), ref: 007EB9EF
SendMessageW.USER32(0000040B,00001000,?), ref: 007EBA06
UpdateWindow.USER32 ref: 007EBA09

Part of subcall function 007D19E0: SystemParametersInfoW.USER32(00000042,0000000C,00000000), ref: 007D1A11

Strings

1 2 3 4 5 0 8, xrefs: 007EB99A

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Window$MessageSend$DestroyLong$ClientInfoParametersRectSystemUpdate
String ID: 1 2 3 4 5 0 8
API String ID: 133368004-396731279
Opcode ID: 1a503aeba917ed700478bb174a702a6ea84cefc648585e538ef816d44a400fe2
Instruction ID: 9a2462d8415f4fd31cbd94a120ca83814f0bd325a3618ebb1e30d1b9fb2c9ea9
Opcode Fuzzy Hash: 1a503aeba917ed700478bb174a702a6ea84cefc648585e538ef816d44a400fe2
Instruction Fuzzy Hash: 6031FB74604384BFE710AB70FC89F6A3FA8FB49710F150515F641A61F2E6B5A804CF62

Uniqueness

Uniqueness Score: -1.00%

Function 007E02C0 Relevance: 24.1, APIs: 16, Instructions: 123windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000065), ref: 007E0304
GetWindowTextLengthW.USER32(00000000), ref: 007E0307
GetDlgItem.USER32(?,00000001), ref: 007E0311
EnableWindow.USER32(00000000), ref: 007E0314
SetWindowLongW.USER32(?,00000008,?), ref: 007E03A7
SendMessageW.USER32(?,00000080,00000000,?), ref: 007E03BF
SetDlgItemTextW.USER32(?,00000064,?), ref: 007E03CF
SetDlgItemTextW.USER32(?,00000065,?), ref: 007E03D5
SendDlgItemMessageW.USER32(?,00000065,000000C5,00000103,00000000), ref: 007E03EC
SendDlgItemMessageW.USER32(?,00000065,000000B9,00000000,00000000), ref: 007E03FA

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Item$MessageSendTextWindow$EnableLengthLong
String ID:
API String ID: 2189001810-0
Opcode ID: 2769c7a9f70e9e0ceb5c348019058bf52c2b15f12436571491411ed09be3a687
Instruction ID: e88bb8d48ad5b55bf5630fdb83efd75da115373ac635c39fa7c6380a21c685b7
Opcode Fuzzy Hash: 2769c7a9f70e9e0ceb5c348019058bf52c2b15f12436571491411ed09be3a687
Instruction Fuzzy Hash: 0F31D9373417147BF2205B69AC8DF6B2B2CF78AB52F004416F740EA1D0D7D6A851DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 007E7688 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 007E8460: ResolveLocaleName.KERNEL32(008E8FF0,?,00000055), ref: 007E848A
Part of subcall function 007E8460: GetLocaleInfoEx.KERNEL32(?,20000001,00000002), ref: 007E84AD

GetDC.USER32 ref: 007E7752
EnumFontsW.GDI32(00000000,Segoe UI,007E7510,00000000), ref: 007E7766
ReleaseDC.USER32(00000000,00000000), ref: 007E776F
GetDC.USER32(00000000), ref: 007E77B2
GetDeviceCaps.GDI32(00000000,0000005A), ref: 007E77BD
ReleaseDC.USER32(00000000,00000000), ref: 007E77CA
MulDiv.KERNEL32(?,00000048,00000000), ref: 007E781E
SystemParametersInfoW.USER32(00000029,000001F8,000001F4,00000000), ref: 007E78DC
MulDiv.KERNEL32(?,00000048,?), ref: 007E78FD

Strings

Segoe UI, xrefs: 007E7737
Microsoft JhengHei UI, xrefs: 007E7702, 007E7764
Microsoft YaHei UI, xrefs: 007E7709
Malgun Gothic, xrefs: 007E7730
Yu Gothic UI, xrefs: 007E7729
WINDOWSTYLE;WINDOW, xrefs: 007E77DC

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: InfoLocaleRelease$CapsDeviceEnumFontsNameParametersResolveSystem
String ID: Malgun Gothic$Microsoft JhengHei UI$Microsoft YaHei UI$Segoe UI$WINDOWSTYLE;WINDOW$Yu Gothic UI
API String ID: 1673905233-1160875775
Opcode ID: 1d5adfd7ee4dce49737020794f8815caf66ec202fff9e8ebd9df0f0620099608
Instruction ID: 90b5fbf713948977a232d7608464af742d9e577282297ac12d7674ba1ce8ef40
Opcode Fuzzy Hash: 1d5adfd7ee4dce49737020794f8815caf66ec202fff9e8ebd9df0f0620099608
Instruction Fuzzy Hash: AB51E0756093819BE7288F66DC8877A77E5FF99301F04452DE946CB290E738CD09C792

Uniqueness

Uniqueness Score: -1.00%

Function 007E8DD0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 121windowstringCOMMON

Download Yara Rule

APIs

Part of subcall function 007E3CE0: SendMessageW.USER32(?,00001032,00000000,00000000), ref: 007E3D18
Part of subcall function 007E3CE0: SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 007E3D28
Part of subcall function 007E3CE0: SendMessageW.USER32(?,?,?,0000104B), ref: 007E3D4D

lstrcpyW.KERNEL32(?,008E96C0), ref: 007E8EAD
PathStripPathW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,00000208), ref: 007E8EB7
PathRemoveExtensionW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,00000208), ref: 007E8EC5
lstrcpyW.KERNEL32(?,Notepad3), ref: 007E8EDD
lstrcpyW.KERNEL32(?,...), ref: 007E8F05
GetMenuItemInfoW.USER32(?,00009C41,00000000,00000030), ref: 007E8F76
SetMenuItemInfoW.USER32(?,00009C41,00000000,00000030), ref: 007E8F94
GetSubMenu.USER32(?,00000000), ref: 007E8FA4
SetMenuDefaultItem.USER32(00000000,?,00000000,00009C41,00000000), ref: 007E8FAB

Strings

..., xrefs: 007E8EF8
0, xrefs: 007E8F44
0, xrefs: 007E8F38
Notepad3, xrefs: 007E8ECD

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Menu$ItemMessagePathSendlstrcpy$Info$DefaultExtensionRemoveStrip
String ID: ...$0$0$Notepad3
API String ID: 2793067833-1122624146
Opcode ID: 5e3c97359c13627227115424369b36df9da8448cf0649be3370195adfe29c9a0
Instruction ID: 478fd76e35ce57447921bb10318e35cef23cecf2314cbaf49bad33a7f09f91f3
Opcode Fuzzy Hash: 5e3c97359c13627227115424369b36df9da8448cf0649be3370195adfe29c9a0
Instruction Fuzzy Hash: D441B5B5904784ABD730DB61CC49F6B77E8BB88705F04091DF688D2191EBB8A148CB97

Uniqueness

Uniqueness Score: -1.00%

Function 007EB760 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 121stringCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 007EB7BF
SetBkColor.GDI32(?,00000000), ref: 007EB7C3
GetSysColor.USER32(00000012), ref: 007EB7E4
SetTextColor.GDI32(?,00000000), ref: 007EB7E8
GetSystemMetrics.USER32(00000021), ref: 007EB80D
GetWindowDC.USER32(?), ref: 007EB816
FrameRect.USER32(00000000,?), ref: 007EB840
GetSysColorBrush.USER32(00000015), ref: 007EB859
FrameRect.USER32(00000000,?,00000000), ref: 007EB866
ReleaseDC.USER32(?,00000000), ref: 007EB86D
lstrlenW.KERNEL32(?,00000000), ref: 007EB87D
ExtTextOutW.GDI32(?,?,?,00000402,?,?,00000000), ref: 007EB89C

Part of subcall function 007D19E0: SystemParametersInfoW.USER32(00000042,0000000C,00000000), ref: 007D1A11

Strings

333, xrefs: 007EB7B6

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Color$FrameRectSystemText$BrushInfoMetricsParametersReleaseWindowlstrlen
String ID: 333
API String ID: 1993733190-2463598333
Opcode ID: c2a70bda50322ec3950ee1ee34a4870c2edccb884732a8bace7b6e7ebe1224ee
Instruction ID: b681ce8d83676ca91bdebaf1fdcd7a5f89929331bc1630445a9401e74fe6588a
Opcode Fuzzy Hash: c2a70bda50322ec3950ee1ee34a4870c2edccb884732a8bace7b6e7ebe1224ee
Instruction Fuzzy Hash: 294134355083849FD3009F65DC88A7BBFA8FF89314F44441AFE9892252D778E885CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 007E5900 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 120stringwindowCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?,0085D420), ref: 007E5933
SendMessageW.USER32(?,00000418,00000000,00000000), ref: 007E5949
SendMessageW.USER32(?,00000418,00000000,00000000), ref: 007E5963
SendMessageW.USER32(?,00000417,00000000,?), ref: 007E597C
wsprintfW.USER32 ref: 007E5996
lstrcatW.KERNEL32(?,?), ref: 007E59A9
CharNextW.USER32(?), ref: 007E59D1
lstrlenW.KERNEL32(?), ref: 007E59E2
lstrlenW.KERNEL32(?), ref: 007E59FF
CharPrevW.USER32(?,00000000), ref: 007E5A12
CharPrevW.USER32(?,00000000), ref: 007E5A2B
lstrcpynW.KERNEL32(?,?,00000200), ref: 007E5A41

Strings

%i , xrefs: 007E5990

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: CharMessageSend$Prevlstrlen$Nextlstrcatlstrcpylstrcpynwsprintf
String ID: %i
API String ID: 2047470491-1318497599
Opcode ID: 06a7542b8238b8b8acaec0f5a1518041ecef37d80a9bf3a8b61a29fc85f4e893
Instruction ID: a3040b99222c3d88ea9dffa05cbdc272c42809f9f3129f92d5dc15e2a2b8c7f0
Opcode Fuzzy Hash: 06a7542b8238b8b8acaec0f5a1518041ecef37d80a9bf3a8b61a29fc85f4e893
Instruction Fuzzy Hash: 4841A2729047489FD3209B65DC85FABB7ECFB89704F40482AF650D3291EB74E805CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 007E9185 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 114windowstringCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(0000000F), ref: 007E91C8
SetBkColor.GDI32(?,00000000), ref: 007E91D0
GetSysColor.USER32(00000012), ref: 007E91F1
SetTextColor.GDI32(?,00000000), ref: 007E91F9
GetSystemMetrics.USER32(00000021), ref: 007E9222
GetWindowDC.USER32(?), ref: 007E922D
FrameRect.USER32(?,?), ref: 007E925F
GetSysColorBrush.USER32(00000015), ref: 007E9284
FrameRect.USER32(00000000,?,00000000), ref: 007E9291
ReleaseDC.USER32(?,00000000), ref: 007E929C
lstrlenW.KERNEL32(?,00000000), ref: 007E92AC
ExtTextOutW.GDI32(?,?,?,00000402,?,?,00000000), ref: 007E92CB

Part of subcall function 007D19E0: SystemParametersInfoW.USER32(00000042,0000000C,00000000), ref: 007D1A11

LoadMenuW.USER32(00000064), ref: 007EA066
GetSubMenu.USER32(00000000,00000004), ref: 007EA071
SetForegroundWindow.USER32(?), ref: 007EA07D
GetCursorPos.USER32(?), ref: 007EA088
SetMenuDefaultItem.USER32(00000000,00009E99,00000000), ref: 007EA096
TrackPopupMenu.USER32(00000000,00000182,?,?,00000000,?,00000000), ref: 007EA0B2
PostMessageW.USER32(?,00000000,00000000,00000000), ref: 007EA0C7
DestroyMenu.USER32(00000000), ref: 007EA0CE
ShowOwnedPopups.USER32(?,00000001), ref: 007EA126

Strings

333, xrefs: 007E91BF

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ColorMenu$FrameRectSystemTextWindow$BrushCursorDefaultDestroyForegroundInfoItemLoadMessageMetricsOwnedParametersPopupPopupsPostReleaseShowTracklstrlen
String ID: 333
API String ID: 3530067508-2463598333
Opcode ID: ca0b93f570daa2911d7e696d92ce31bb552c1c59cb276a4128489376affd07b7
Instruction ID: 83e63cafa7d95e9e2e93e530e7137c46677429b431dfa6332c5803f7294d3a71
Opcode Fuzzy Hash: ca0b93f570daa2911d7e696d92ce31bb552c1c59cb276a4128489376affd07b7
Instruction Fuzzy Hash: AF41E436108385EFD7109FA4D848A7AB7F8FF89310F04490AFAC597261D774A846CB62

Uniqueness

Uniqueness Score: -1.00%

Function 007EF860 Relevance: 22.7, APIs: 15, Instructions: 159stringwindowCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?,?), ref: 007EF899
ExpandEnvironmentStringsW.KERNEL32(?,?,00000138), ref: 007EF8AD
lstrcpynW.KERNEL32(?,?,00000104), ref: 007EF8C9
lstrcpyW.KERNEL32(?,?), ref: 007EF8FA
GetFileAttributesW.KERNEL32(?), ref: 007EF937
SetCurrentDirectoryW.KERNEL32(?), ref: 007EF952
PostMessageW.USER32(00000111,00019D0D,00000000), ref: 007EF972
SendMessageW.USER32(00001013,00000000,00000000), ref: 007EF987
lstrcpyW.KERNEL32(?,?), ref: 007EF9B1
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000200), ref: 007EF9E0
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 007EF9F2
PathIsRootW.SHLWAPI(?), ref: 007EFA0C
SetCurrentDirectoryW.KERNEL32(?), ref: 007EFA21
SendMessageW.USER32(00000111,00019D0D,00000000), ref: 007EFA3F
SendMessageW.USER32(00001013,00000000,00000000), ref: 007EFA66

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Message$Sendlstrcpy$CurrentDirectoryFile$AttributesEnvironmentExpandInfoPathPostRootStringslstrcpyn
String ID:
API String ID: 3189554786-0
Opcode ID: 6540ae624b6c9a972ef4e8faa064b41741bc31e157adb1b3660f67c81ffd7982
Instruction ID: 822e1f1869106bdb7308351d4d3a6547ea1eed58dc5fe42de45759ee0e55b6a6
Opcode Fuzzy Hash: 6540ae624b6c9a972ef4e8faa064b41741bc31e157adb1b3660f67c81ffd7982
Instruction Fuzzy Hash: 7F51A4B5601384ABE7309B61EC4AFEF77ACBB98700F44483AF649DB191EA749504CB52

Uniqueness

Uniqueness Score: -1.00%

Function 007E1BB0 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 140stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007E7A20: FindResourceW.KERNEL32(00000000,?,00000005,?,?), ref: 007E7A37
Part of subcall function 007E7A20: LoadResource.KERNEL32(00000000,00000000), ref: 007E7A4A
Part of subcall function 007E7A20: LockResource.KERNEL32(00000000), ref: 007E7A5B
Part of subcall function 007E7A20: SizeofResource.KERNEL32(00000000,00000000), ref: 007E7A6E
Part of subcall function 007E7A20: LocalAlloc.KERNEL32(00000040,00000040), ref: 007E7A84
Part of subcall function 007E7A20: FreeResource.KERNEL32(00000000), ref: 007E7AA0
Part of subcall function 007E7A20: lstrlenW.KERNEL32(?), ref: 007E7B1D

DialogBoxIndirectParamW.USER32(?,00000000,?,Function_00011240,00000001), ref: 007E1BF3
LocalFree.KERNEL32(00000000,?,Function_00011240,00000001), ref: 007E1C00

Part of subcall function 007E6000: PathFindExtensionW.SHLWAPI(?,.lnk,775DF670), ref: 007E6027
Part of subcall function 007E6000: lstrcmpiW.KERNEL32(00000000), ref: 007E602E

lstrcpyW.KERNEL32(?,?), ref: 007E1C69
PathFindFileNameW.SHLWAPI(?), ref: 007E1C77
PathAppendW.SHLWAPI(?,00000000), ref: 007E1C86
SHFileOperationW.SHELL32(?), ref: 007E1CCE
GetFileAttributesW.KERNEL32(?), ref: 007E1CE8
SetFileAttributesW.KERNEL32(?,00000000), ref: 007E1CFE
lstrcpyW.KERNEL32(?,?), ref: 007E1D98
GetShortPathNameW.KERNEL32(?,?,00000104), ref: 007E1DAC
ShellExecuteExW.SHELL32(0000003C), ref: 007E1DB7

Part of subcall function 007E6080: CoCreateInstance.OLE32(0085378C,00000000,00000001,0084FD7C,?,0000C356,?), ref: 007E60AF
Part of subcall function 007E6080: lstrcpyW.KERNEL32(?,?), ref: 007E60DB
Part of subcall function 007E6080: ExpandEnvironmentStringsW.KERNEL32(?,?,00000138), ref: 007E6152
Part of subcall function 007E6080: lstrcpynW.KERNEL32(?,?,?), ref: 007E616C

Strings

<, xrefs: 007E1D3C

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Resource$FilePath$Findlstrcpy$AttributesFreeLocalName$AllocAppendCreateDialogEnvironmentExecuteExpandExtensionIndirectInstanceLoadLockOperationParamShellShortSizeofStringslstrcmpilstrcpynlstrlen
String ID: <
API String ID: 622433095-4251816714
Opcode ID: de0bec476bc76c18d1c1bea2368e84670cb80f57878ee3bcef2ba234b2172731
Instruction ID: edb1bd745ae24d81e1ac810e602562fac4b20ff0d0e43266d5cd4b8960c87db6
Opcode Fuzzy Hash: de0bec476bc76c18d1c1bea2368e84670cb80f57878ee3bcef2ba234b2172731
Instruction Fuzzy Hash: D25181B15083459BD720DF61DC49B9BB7E9BF89304F40492EF698D3240EBB9D548CB92

Uniqueness

Uniqueness Score: -1.00%

Function 007F2C6A Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(008E76F4,00000FA0,?,?,007F2C48), ref: 007F2C76
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,007F2C48), ref: 007F2C81
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,007F2C48), ref: 007F2C92
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 007F2CA4
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 007F2CB2
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,007F2C48), ref: 007F2CD5
DeleteCriticalSection.KERNEL32(008E76F4,00000007,?,?,007F2C48), ref: 007F2CF1
CloseHandle.KERNEL32(00000000,?,?,007F2C48), ref: 007F2D01

Strings

kernel32.dll, xrefs: 007F2C8D
SleepConditionVariableCS, xrefs: 007F2C9E
api-ms-win-core-synch-l1-2-0.dll, xrefs: 007F2C7C
WakeAllConditionVariable, xrefs: 007F2CAA

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 37014f4aa3516e640807c03b9c1385c960b8c84b9e5348c1b2e936b37e8c5592
Instruction ID: 005007627dddb9efa488586ccec6c999662e3ce130f65915b9cdee597dcdcee2
Opcode Fuzzy Hash: 37014f4aa3516e640807c03b9c1385c960b8c84b9e5348c1b2e936b37e8c5592
Instruction Fuzzy Hash: 0601D478684B52ABDB211F74BC4CA3A3A58FB56B06B040051FE24E6360EBB8C801CA71

Uniqueness

Uniqueness Score: -1.00%

Function 007E9504 Relevance: 19.6, APIs: 13, Instructions: 124windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,?,00000004), ref: 007E9537
GetWindowRect.USER32(?), ref: 007E9548
SendMessageW.USER32(00000005,00000000,00000000), ref: 007E9579
GetWindowRect.USER32(?), ref: 007E958A
BeginDeferWindowPos.USER32(00000002), ref: 007E95A0
DeferWindowPos.USER32(00000000,00000000,00000000,00000000,?,00000064,00000014), ref: 007E95C7
GetWindowRect.USER32(?), ref: 007E95E1
DeferWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000014), ref: 007E9622
EndDeferWindowPos.USER32(?), ref: 007E9629
SendMessageW.USER32(0000101E,00000000,0000FFFE), ref: 007E9647
SendMessageW.USER32(00000404,00000001,?), ref: 007E9663
InvalidateRect.USER32(00000000,00000001,?,?,?,?,?,?,?,?,?,?,00000014), ref: 007E966F
SendMessageW.USER32(0000040B,00001000,0085D420), ref: 007E968A

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Window$DeferMessageRectSend$BeginInvalidate
String ID:
API String ID: 1489923645-0
Opcode ID: f72c70db80b2d1ab3c85ccc630547adc5f0af325ccc174611c90febee5b7e2b7
Instruction ID: 6cc9ca77b974bf09867a56bde22a2f88a2f9fb66c2f48ff130ad98f715842953
Opcode Fuzzy Hash: f72c70db80b2d1ab3c85ccc630547adc5f0af325ccc174611c90febee5b7e2b7
Instruction Fuzzy Hash: 6741B032205390AFD7258FA4ED49F6A7BB5FB88B10F05451DF640AB2F0D7B1A800DB92

Uniqueness

Uniqueness Score: -1.00%

Function 007EBA30 Relevance: 19.6, APIs: 13, Instructions: 121windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,634AD31B,00000004), ref: 007EBA7B
GetWindowRect.USER32(?), ref: 007EBA8C
SendMessageW.USER32(00000005,00000000,00000000), ref: 007EBABB
GetWindowRect.USER32(?), ref: 007EBAC8
BeginDeferWindowPos.USER32(00000002), ref: 007EBAD6
DeferWindowPos.USER32(00000000,00000000,00000000,00000000,00000064,00000064,00000014), ref: 007EBAFD
GetWindowRect.USER32(?), ref: 007EBB17
DeferWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000014), ref: 007EBB4D
EndDeferWindowPos.USER32(?), ref: 007EBB54
SendMessageW.USER32(0000101E,00000000,0000FFFE), ref: 007EBB6C
SendMessageW.USER32(00000404,00000001,?), ref: 007EBB88
InvalidateRect.USER32(00000000,00000001), ref: 007EBB94
SendMessageW.USER32(0000040B,00001000,0085D420), ref: 007EBBAF

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Window$DeferMessageRectSend$BeginInvalidate
String ID:
API String ID: 1489923645-0
Opcode ID: b9ec97b4199468fcb5a945a87e0dcc3cb1a2a1f7c529737c4b2e483c5d137935
Instruction ID: 236d192fd4f095f9f3c9bdfbe389e38b7ddb81393d7455c592095e832326140b
Opcode Fuzzy Hash: b9ec97b4199468fcb5a945a87e0dcc3cb1a2a1f7c529737c4b2e483c5d137935
Instruction Fuzzy Hash: B341B132240345BFD7148FA4EC89F6A7FA9FB48B04F054529F240AB1B0D7B5B804DB56

Uniqueness

Uniqueness Score: -1.00%

Function 007D1390 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,?,?), ref: 007D13D7

Part of subcall function 007D19E0: SystemParametersInfoW.USER32(00000042,0000000C,00000000), ref: 007D1A11

SendMessageW.USER32(?,00001024,00000000,?), ref: 007D1450
SendMessageW.USER32(?,00001026,00000000,?), ref: 007D1477
SendMessageW.USER32(?,00001001,00000000,?), ref: 007D1485
SendMessageW.USER32(?,0000031A,?,?), ref: 007D14CC
RedrawWindow.USER32(?,00000000,00000000,00000407), ref: 007D14D8
#413.COMCTL32(?,?,?,?), ref: 007D14EA
SetTextColor.GDI32(?,?), ref: 007D1513
#413.COMCTL32(?,?,?,?), ref: 007D1542

Strings

ItemsView, xrefs: 007D1418
Header, xrefs: 007D148E

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MessageSend$#413$ColorInfoParametersRedrawSystemTextWindow
String ID: Header$ItemsView
API String ID: 4170420104-3116908764
Opcode ID: 8e3f3e79f2d198c1d79ca98d8ba6826e811f5fb2bb0513e14a2d52e6cc741d44
Instruction ID: c3f59cb3bac2d15d0ebd1c4b7cde167368ce852614a2aa1502e7f236b8d4920a
Opcode Fuzzy Hash: 8e3f3e79f2d198c1d79ca98d8ba6826e811f5fb2bb0513e14a2d52e6cc741d44
Instruction Fuzzy Hash: A1410932248385BFE3215FA4EC45F6F7FB8FB99704F00051AF685A51A1C3A9D841D722

Uniqueness

Uniqueness Score: -1.00%

Function 007D37A0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 141fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(008E8DE8,C0000000,00000003,00000000,00000004,00000080,00000000), ref: 007D3821
LockFileEx.KERNEL32(00000000,00000002,00000000,000000FF,00000000,?), ref: 007D3840
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,?,00000040), ref: 007D38D5
FlushFileBuffers.KERNEL32(?,?,?,Settings2,ReuseWindow,?,00000000,00000001,00000001), ref: 007D390A
UnlockFileEx.KERNEL32(?,00000000,000000FF,00000000,?,?,?,?,Settings2,ReuseWindow,?,00000000,00000001,00000001), ref: 007D391C

Strings

Settings2, xrefs: 007D38EE
ReuseWindow, xrefs: 007D38E9
AcquireWriteFileLock(): INVALID FILE HANDLE!, xrefs: 007D393E
AcquireWriteFileLock(): NO EXCLUSIVE LOCK ACQUIRED!, xrefs: 007D384F
%ld, xrefs: 007D3893

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: File$BuffersByteCharCreateFlushLockMultiUnlockWide
String ID: %ld$AcquireWriteFileLock(): INVALID FILE HANDLE!$AcquireWriteFileLock(): NO EXCLUSIVE LOCK ACQUIRED!$ReuseWindow$Settings2
API String ID: 638334387-856838195
Opcode ID: 259710622e3445ec4914dc39f72844163e8b6413f088431d3fbedb2d987260a7
Instruction ID: a6a54437b9313531f6dbccd943a4a7ac5c606f69a12e31fcba19360bdbcf971d
Opcode Fuzzy Hash: 259710622e3445ec4914dc39f72844163e8b6413f088431d3fbedb2d987260a7
Instruction Fuzzy Hash: 9E413971604340ABD3209B64DC56FAE73B8FB85710F14062EF9A9972D0EBF89A498353

Uniqueness

Uniqueness Score: -1.00%

Function 007EC6E9 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 121windowfilestringCOMMON

Download Yara Rule

APIs

Part of subcall function 007E6890: SendMessageW.USER32(?,00001032,00000000,00000000), ref: 007E68B6

MessageBeep.USER32(00000000), ref: 007EC0CC

Part of subcall function 007E3CE0: SendMessageW.USER32(?,00001032,00000000,00000000), ref: 007E3D18
Part of subcall function 007E3CE0: SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 007E3D28
Part of subcall function 007E3CE0: SendMessageW.USER32(?,?,?,0000104B), ref: 007E3D4D

lstrcpyW.KERNEL32(?,?), ref: 007EC733

Part of subcall function 007E4FE0: LoadStringW.USER32(0000A411,?,00000000,00000001), ref: 007E4FF2
Part of subcall function 007E4FE0: LoadStringW.USER32(0000A411,?,?), ref: 007E5008

Part of subcall function 007E6530: lstrlenW.KERNEL32(?,75B0CE10,007DFA1F), ref: 007E6534
Part of subcall function 007E6530: CharPrevW.USER32(?,00000000,?), ref: 007E654A

GetSaveFileNameW.COMDLG32(?,?,?,?,?,?), ref: 007EC7BE

Part of subcall function 007E4FA0: LoadCursorW.USER32(00000000,00007F02), ref: 007E4FA7
Part of subcall function 007E4FA0: SetCursor.USER32(00000000,?,?,?,?,?), ref: 007E4FAE
Part of subcall function 007E4FA0: DestroyCursor.USER32(00000000), ref: 007E4FB5

Part of subcall function 007E5060: LocalAlloc.KERNEL32(00000040,?,00000000,775A3070,75B03760,?,007EF281,?,00000100,00002712,?), ref: 007E506E
Part of subcall function 007E5060: LoadStringW.USER32(?,00000000,?), ref: 007E5087
Part of subcall function 007E5060: LoadStringW.USER32(?,00000000,?), ref: 007E509E
Part of subcall function 007E5060: LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 007E50C2
Part of subcall function 007E5060: lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 007E50C9

Part of subcall function 007E58E0: SendMessageW.USER32(0000040B,?,?), ref: 007E58F6

SendMessageW.USER32(00000409,00000001,00000000), ref: 007EC81A
InvalidateRect.USER32(00000000,00000001,?,?,?,?,?,?,00000000,00000058), ref: 007EC826
UpdateWindow.USER32 ref: 007EC832
CopyFileW.KERNEL32(?,?,00000000,?,?,?,?,?,?,00000000,00000058), ref: 007EC84A
GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,00000000,00000058), ref: 007EC87E
SetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,?,?,00000000,00000058), ref: 007EC894
SendMessageW.USER32(00000409,00000000,00000000), ref: 007EC8BC

Part of subcall function 007E2D90: LoadStringW.USER32(?,?,00000200), ref: 007E2DEB
Part of subcall function 007E2D90: LoadStringW.USER32(?,?,00000200), ref: 007E2E09

Strings

X, xrefs: 007EC776

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Message$LoadSend$String$File$Cursor$AttributesLocallstrlen$AllocBeepCharCopyDestroyFreeInvalidateNamePrevRectSaveUpdateWindowlstrcpy
String ID: X
API String ID: 1551183220-3081909835
Opcode ID: c091313260b1205d69282e9b72c2311c0c890128470672d3a1c1f8b7191b66db
Instruction ID: 5b703b3bf4f7455bb536602a48025002e4b7b503ffda118e57e3f457c421ca09
Opcode Fuzzy Hash: c091313260b1205d69282e9b72c2311c0c890128470672d3a1c1f8b7191b66db
Instruction Fuzzy Hash: 3A41B6B56453849BF330DB61DC4AFDB73A8BB88700F44492AF648D61D2EBB8A105CB52

Uniqueness

Uniqueness Score: -1.00%

Function 007DDCE1 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 113stringwindowCOMMON

Download Yara Rule

APIs

GetDlgItemTextW.USER32(?,00000064,?,00000104), ref: 007DDD02

Part of subcall function 007E6590: ExpandEnvironmentStringsW.KERNEL32(?,00000138,00000138,?,00000000), ref: 007E65B5
Part of subcall function 007E6590: lstrcpynW.KERNEL32(?,?,00000104), ref: 007E65C6

lstrcpyW.KERNEL32(?,?), ref: 007DDD2F

Part of subcall function 007E6380: CharNextW.USER32(?,?,775DF670,?,007DF938), ref: 007E63A1
Part of subcall function 007E6380: lstrlenW.KERNEL32(?,?,775DF670,?,007DF938), ref: 007E63B2
Part of subcall function 007E6380: lstrlenW.KERNEL32(?,?,?,007DF938), ref: 007E63C7
Part of subcall function 007E6380: CharPrevW.USER32(?,00000000,?,?,007DF938), ref: 007E63D4
Part of subcall function 007E6380: CharPrevW.USER32(?,00000000,?,?,007DF938), ref: 007E63E7

StrChrW.SHLWAPI(?,00000020), ref: 007DDD7D
lstrcpyW.KERNEL32(?,-00000002), ref: 007DDD98
GetOpenFileNameW.COMDLG32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000058), ref: 007DDE2F
lstrcatW.KERNEL32(?,0085DDEC), ref: 007DDE63
lstrcatW.KERNEL32(?,00000000), ref: 007DDE75
SetDlgItemTextW.USER32(?,00000064,?), ref: 007DDE82
PostMessageW.USER32(?,00000028,00000001,00000000), ref: 007DDE8F

Strings

X, xrefs: 007DDDF4
", xrefs: 007DDD4B

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Char$ItemPrevTextlstrcatlstrcpylstrlen$EnvironmentExpandFileMessageNameNextOpenPostStringslstrcpyn
String ID: "$X
API String ID: 3652824999-1355838460
Opcode ID: c24e8f7a47820bedab892e3dd60696b5d4ca37a31a6a476f85bc5d6c41c6c2d1
Instruction ID: 687410396628478316538b5262056749aa057d382599a2ef76e999ea39b526df
Opcode Fuzzy Hash: c24e8f7a47820bedab892e3dd60696b5d4ca37a31a6a476f85bc5d6c41c6c2d1
Instruction Fuzzy Hash: 8D414C756443859AD770DB60D845BEBB3E8BB84700F00492EE695D7291EFB49508CB53

Uniqueness

Uniqueness Score: -1.00%

Function 007E3080 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 88windowmemorystringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,0000022C,?,?,?), ref: 007E30B3
SetPropW.USER32(00000000,DirListData,00000000), ref: 007E30DE
lstrcpyW.KERNEL32(00000010,0085D420), ref: 007E3104
SHGetFileInfoW.SHELL32(C:\,00000000,?,000002B4,00004001), ref: 007E3120
SendMessageW.USER32(00000000,00001003,00000001,00000000), ref: 007E3135
SHGetFileInfoW.SHELL32(C:\,00000000,?,000002B4,00004000), ref: 007E314D
SendMessageW.USER32(00000000,00001003,00000000,00000000), ref: 007E315C
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?), ref: 007E3180
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?), ref: 007E3190

Strings

C:\, xrefs: 007E311B, 007E3148
DirListData, xrefs: 007E30D8

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: CreateEventFileInfoMessageSend$AllocGlobalProplstrcpy
String ID: C:\$DirListData
API String ID: 1243389431-2784504048
Opcode ID: 2b01086042b0adf8a1c5313ee4cd6c6071a7bc7d900c33c96bcfd11d764465ea
Instruction ID: fea266fe9689baead6a7c7cb687b8edb861bdb5283ca3662462f9d963df2f6c2
Opcode Fuzzy Hash: 2b01086042b0adf8a1c5313ee4cd6c6071a7bc7d900c33c96bcfd11d764465ea
Instruction Fuzzy Hash: 593171B1680304BBF720AF50DC8AFA67B98FB09B01F400455FB18AE2C1D7F9A5448B61

Uniqueness

Uniqueness Score: -1.00%

Function 007F0CB0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 007F0CC7
MonitorFromRect.USER32 ref: 007F0CEF
GetMonitorInfoW.USER32(00000000,?), ref: 007F0CFB
EqualRect.USER32(?,?), ref: 007F0D4D
SystemParametersInfoW.USER32(00000048,00000008,?,00000000), ref: 007F0D80
DrawAnimatedRects.USER32(?,00000003,?,?), ref: 007F0D9A
OffsetRect.USER32(?,?,?), ref: 007F0DB7
SetWindowPlacement.USER32(?,0000002C), ref: 007F0DC3
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 007F0DCF

Strings

(, xrefs: 007F0CE1
,, xrefs: 007F0D0F

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Rect$Window$InfoMonitorPlacement$AnimatedDrawEqualFromOffsetParametersRectsSystem
String ID: ($,
API String ID: 1691248947-170869519
Opcode ID: 4236f38821146bcdb94c40a48f3c1b8aab2297a14de5f729fc14e8396c8f951d
Instruction ID: d7d7c3de4cc1a298bbae13baee75eaa940ce729e7aa8e8eb2dcb924f3cc9b64c
Opcode Fuzzy Hash: 4236f38821146bcdb94c40a48f3c1b8aab2297a14de5f729fc14e8396c8f951d
Instruction Fuzzy Hash: 79311AB5508304AFD300CF64D989AAFB7F8FF89704F40891EF58182250EB74E948CB52

Uniqueness

Uniqueness Score: -1.00%

Function 007EDB62 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 007EDB68
MonitorFromRect.USER32 ref: 007EDB90
GetMonitorInfoW.USER32(00000000,?), ref: 007EDB9C
EqualRect.USER32(?,?), ref: 007EDC06
SystemParametersInfoW.USER32(00000048,00000008,?,00000000), ref: 007EDC3F
DrawAnimatedRects.USER32(?,00000003,?,?), ref: 007EDC5C
OffsetRect.USER32(?,?,?), ref: 007EDC7C
SetWindowPlacement.USER32(?,0000002C), ref: 007EDC91
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 007EDC9C

Strings

,, xrefs: 007EDBB0
(, xrefs: 007EDB82

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Rect$Window$InfoMonitorPlacement$AnimatedDrawEqualFromOffsetParametersRectsSystem
String ID: ($,
API String ID: 1691248947-170869519
Opcode ID: 462a631af8aa48b96592dfe1dab0680429981b31b5cbfd8aba4e27cb342832fc
Instruction ID: 3391a7927b4b927872c7d45ead2d79e3ca1abd1caf6212e214d5165ec1f52bee
Opcode Fuzzy Hash: 462a631af8aa48b96592dfe1dab0680429981b31b5cbfd8aba4e27cb342832fc
Instruction Fuzzy Hash: C431D9B55093849FE320CF64D848BAFB7E8FB88304F049A1EF5C996251EB74A544CB92

Uniqueness

Uniqueness Score: -1.00%

Function 007E3280 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 50windowsynchronizationCOMMON

Download Yara Rule

APIs

GetPropW.USER32(?,DirListData), ref: 007E328A
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,007E3420,?,?), ref: 007E3298
WaitForSingleObject.KERNEL32(?,00000000,?,?,?,?,?,?,?,007E3420,?,?), ref: 007E32A6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007E32D2
TranslateMessage.USER32(?), ref: 007E32DD
DispatchMessageW.USER32(?), ref: 007E32E4
WaitForSingleObject.KERNEL32(?,00000000,?,?,?,?,?,?,?,007E3420,?,?), ref: 007E32EE
ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,007E3420,?,?), ref: 007E3301
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,007E3420,?,?), ref: 007E330D

Strings

DirListData, xrefs: 007E3284
C:\Users\user\Desktop, xrefs: 007E32B0

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: EventMessage$ObjectSingleWait$DispatchPeekPropResetTranslate
String ID: C:\Users\user\Desktop$DirListData
API String ID: 3160958571-3395149057
Opcode ID: 28b5620a1e67189f5f126932eb191b762f598379d911ae3f2b3ce4ae085d456d
Instruction ID: da694747491045404745aeb9c25f553f3ceb6cc5a03d2d183fcf8d87e4685738
Opcode Fuzzy Hash: 28b5620a1e67189f5f126932eb191b762f598379d911ae3f2b3ce4ae085d456d
Instruction Fuzzy Hash: 91015236240301BBE720ABA5EC4DF967BB8FB49711F040919F695D2060EB75E950CB20

Uniqueness

Uniqueness Score: -1.00%

Function 007E3860 Relevance: 18.2, APIs: 12, Instructions: 231windowmemorysynchronizationCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 007E3890
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 007E38AD
CoInitialize.OLE32(00000000), ref: 007E38B8
WaitForSingleObject.KERNEL32(?,00000000,?,00001004,00000000,00000000), ref: 007E38E8
SendMessageW.USER32 ref: 007E390F
CoTaskMemAlloc.OLE32(?), ref: 007E39D9
SHGetFileInfoW.SHELL32(00000000,00000000,?,000002B4,00004009), ref: 007E3A1A
CoTaskMemFree.OLE32(00000000), ref: 007E3A21
SHGetDataFromIDListW.SHELL32(?,?,00000001,?,00000250), ref: 007E3ACD
SendMessageW.USER32(?,0000104C,00000000,00000002), ref: 007E3B09
CoUninitialize.OLE32(?,00001004,00000000,00000000), ref: 007E3B32
SetEvent.KERNEL32(?), ref: 007E3B3E

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MessageSend$EventTask$AllocDataFileFreeFromInfoInitializeListObjectResetSingleUninitializeWait
String ID:
API String ID: 2249403244-0
Opcode ID: ee2862f9fc451c43a9691bdb5395a297fcd72404875be3a7f1be0343798eea41
Instruction ID: d4f381ea14c9802abe5a827d4317af6837c87398a210d3a4c0f65049247d4bac
Opcode Fuzzy Hash: ee2862f9fc451c43a9691bdb5395a297fcd72404875be3a7f1be0343798eea41
Instruction Fuzzy Hash: 93918A74506341ABD720CF65C888B2BBBF4FF89714F04492DFA859B251D778EA05CB62

Uniqueness

Uniqueness Score: -1.00%

Function 007ECA74 Relevance: 18.1, APIs: 12, Instructions: 132stringwindowCOMMON

Download Yara Rule

APIs

MessageBeep.USER32(00000000), ref: 007EC0CC

Part of subcall function 007E3CE0: SendMessageW.USER32(?,00001032,00000000,00000000), ref: 007E3D18
Part of subcall function 007E3CE0: SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 007E3D28
Part of subcall function 007E3CE0: SendMessageW.USER32(?,?,?,0000104B), ref: 007E3D4D

Part of subcall function 007E64F0: lstrlenW.KERNEL32(?,?,?,007DE260), ref: 007E64F5
Part of subcall function 007E64F0: CharPrevW.USER32(?,?,?,?,007DE260), ref: 007E6512
Part of subcall function 007E64F0: CharPrevW.USER32(?,?,?,?,?,007DE260), ref: 007E651C

SendMessageW.USER32(00001032,00000000,00000000), ref: 007ECA89
lstrcpyW.KERNEL32(?,00000000), ref: 007ECAD5

Part of subcall function 007E7A20: FindResourceW.KERNEL32(00000000,?,00000005,?,?), ref: 007E7A37
Part of subcall function 007E7A20: LoadResource.KERNEL32(00000000,00000000), ref: 007E7A4A
Part of subcall function 007E7A20: LockResource.KERNEL32(00000000), ref: 007E7A5B
Part of subcall function 007E7A20: SizeofResource.KERNEL32(00000000,00000000), ref: 007E7A6E
Part of subcall function 007E7A20: LocalAlloc.KERNEL32(00000040,00000040), ref: 007E7A84
Part of subcall function 007E7A20: FreeResource.KERNEL32(00000000), ref: 007E7AA0
Part of subcall function 007E7A20: lstrlenW.KERNEL32(?), ref: 007E7B1D

DialogBoxIndirectParamW.USER32(?,00000000,?,Function_000102C0,?), ref: 007ECAFD
LocalFree.KERNEL32(00000000,?,Function_000102C0,?), ref: 007ECB0A
lstrcpyW.KERNEL32(?), ref: 007ECB6C
lstrcatW.KERNEL32(?,?), ref: 007ECB8F
lstrcpyW.KERNEL32(?,?), ref: 007ECBD3
lstrcpyW.KERNEL32(?,?), ref: 007ECBE5
SHFileOperationW.SHELL32(?,?,?,?,?,Function_000102C0,?), ref: 007ECBEC
SendMessageW.USER32(?,00000111,00019D0D,00000000), ref: 007ECC1D
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000200), ref: 007ECC3B

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Message$ResourceSend$lstrcpy$CharFileFreeLocalPrevlstrlen$AllocBeepDialogFindIndirectInfoLoadLockOperationParamSizeoflstrcat
String ID:
API String ID: 2905323290-0
Opcode ID: 1222bd4bf19003f490a5f77d393601a30b031515adc4dc176d4d71473d9d1151
Instruction ID: 860f6609dcf896e39a580efc59f66c430843b3e71f985ce7e28e55621cb4dbc8
Opcode Fuzzy Hash: 1222bd4bf19003f490a5f77d393601a30b031515adc4dc176d4d71473d9d1151
Instruction Fuzzy Hash: D441A5B6544388AAD730DB60DC89FDBB7ECBF89300F00492AF659D7191EB74A548CB52

Uniqueness

Uniqueness Score: -1.00%

Function 007E6950 Relevance: 18.1, APIs: 12, Instructions: 125stringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,008E9AE0,00000100), ref: 007E69C0
wsprintfW.USER32 ref: 007E69F3
DdeInitializeW.USER32(?,Function_00016930,00000010,00000000), ref: 007E6A0A
DdeCreateStringHandleW.USER32(?,008E90A0,000004B0), ref: 007E6A2E
DdeCreateStringHandleW.USER32(?,008E94C0,000004B0), ref: 007E6A40
DdeConnect.USER32(?,00000000,00000000,00000000), ref: 007E6A5A
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00004050,000000FF,00000000), ref: 007E6A7C
DdeClientTransaction.USER32(?,00000000), ref: 007E6A92
DdeDisconnect.USER32(00000000), ref: 007E6A99
DdeFreeStringHandle.USER32(?,00000000), ref: 007E6ABA
DdeFreeStringHandle.USER32(?,00000000), ref: 007E6AC5
DdeUninitialize.USER32(?), ref: 007E6ACB

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: HandleString$CreateFree$ClientConnectDisconnectInitializeTransactionUninitializelstrcpynlstrlenwsprintf
String ID:
API String ID: 4165874755-0
Opcode ID: 03c2f764d4a1a66bca7b6fd124ca661021f3fa18ed3a9e3cc97de16e1a0160ec
Instruction ID: 015f8357b3c72987c706dddd8024730dff46b9e450d4ca783a51e0f9b4dc1103
Opcode Fuzzy Hash: 03c2f764d4a1a66bca7b6fd124ca661021f3fa18ed3a9e3cc97de16e1a0160ec
Instruction Fuzzy Hash: AE414575904344ABD720DF51DC09BAB37A8FB98354F008429FA45E32E0E7B9E848C796

Uniqueness

Uniqueness Score: -1.00%

Function 007E7C80 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 124windowCOMMON

Download Yara Rule

APIs

FindWindowExW.USER32(00000000,00000000,Shell_TrayWnd,00000000), ref: 007E7CA3
FindWindowExW.USER32(00000000,00000000,TrayNotifyWnd,00000000), ref: 007E7CB3
GetWindowRect.USER32(00000000,?), ref: 007E7CBB
SHAppBarMessage.SHELL32(00000005,?), ref: 007E7CE1

Strings

$, xrefs: 007E7CD6
Shell_TrayWnd, xrefs: 007E7C9A, 007E7D5D
TrayNotifyWnd, xrefs: 007E7CAB

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Window$Find$MessageRect
String ID: $$Shell_TrayWnd$TrayNotifyWnd
API String ID: 634609282-1160186678
Opcode ID: 978174cbe61beaac1e8322154c54dc7719896cebb607d7daa0130d5268519f3f
Instruction ID: 99d2e3cf83b7e7ddaf3fb6c65509c0e8772d654736facd0d5a3090ed16eef7a0
Opcode Fuzzy Hash: 978174cbe61beaac1e8322154c54dc7719896cebb607d7daa0130d5268519f3f
Instruction Fuzzy Hash: 76415DB56053019FD314DF2ACD85B9ABBE4FF98711F50481EE89AD7380E678E904CB51

Uniqueness

Uniqueness Score: -1.00%

Function 007EC388 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 108stringfilewindowCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?,0085D420), ref: 007EC39B

Part of subcall function 007E4FE0: LoadStringW.USER32(0000A411,?,00000000,00000001), ref: 007E4FF2
Part of subcall function 007E4FE0: LoadStringW.USER32(0000A411,?,?), ref: 007E5008

Part of subcall function 007E6530: lstrlenW.KERNEL32(?,75B0CE10,007DFA1F), ref: 007E6534
Part of subcall function 007E6530: CharPrevW.USER32(?,00000000,?), ref: 007E654A

GetSaveFileNameW.COMDLG32 ref: 007EC451
CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 007EC479
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000058), ref: 007EC4A2
lstrcpyW.KERNEL32(?,?), ref: 007EC4B8
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,00000000,00000058), ref: 007EC4C2
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00000000,00000058), ref: 007EC4D0
SendMessageW.USER32(?,00000111,00019D0D,00000000), ref: 007EC4E9
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000200), ref: 007EC507

Part of subcall function 007E4140: GetShortPathNameW.KERNEL32(?,?,00000104), ref: 007E41A1
Part of subcall function 007E4140: SendMessageW.USER32 ref: 007E4229
Part of subcall function 007E4140: GetShortPathNameW.KERNEL32(?,?,00000104), ref: 007E4254
Part of subcall function 007E4140: lstrcmpiW.KERNEL32(?,?), ref: 007E4266
Part of subcall function 007E4140: SendMessageW.USER32(?,00001053,00000000,?), ref: 007E427C

Strings

X, xrefs: 007EC3F0

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: File$MessageNamePathSend$LoadShortStringlstrcpy$CharCloseCreateCurrentDirectoryHandleInfoPrevRemoveSaveSpeclstrcmpilstrlen
String ID: X
API String ID: 394757100-3081909835
Opcode ID: 206ef89cfd9b48fbabb9c32ade326890b337892a6dbea0b6718fcdc281c3423a
Instruction ID: 6a6eef2cdbc0f1e2055099107e8a1fdda8878617a52b417006e3b8d84555766a
Opcode Fuzzy Hash: 206ef89cfd9b48fbabb9c32ade326890b337892a6dbea0b6718fcdc281c3423a
Instruction Fuzzy Hash: A94154755453889AF730DB51DC49FDBB3E8BB88700F044929F699D71C2EBB46148CB52

Uniqueness

Uniqueness Score: -1.00%

Function 007DDB60 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?,0085D420), ref: 007DDBA3
LoadStringW.USER32(?,?,00000100), ref: 007DDBBA
LoadStringW.USER32(?,?,00000100), ref: 007DDBD5
SHGetSpecialFolderLocation.SHELL32(?,?,?,?,?,00000100), ref: 007DDBE8
CoTaskMemFree.OLE32(?,?,?,?,?,?,00000100), ref: 007DDBF6
SHBrowseForFolderW.SHELL32 ref: 007DDC31
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 007DDC45
CoTaskMemFree.OLE32(00000000), ref: 007DDC4C
CoTaskMemFree.OLE32(?), ref: 007DDC57

Strings

A, xrefs: 007DDC1D

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: FreeTask$FolderLoadString$BrowseFromListLocationPathSpeciallstrcpy
String ID: A
API String ID: 3620191483-3554254475
Opcode ID: 64cf166d82de8a797ffdfc4fb0a1708a697c15c3db9a868427a266cb2015acd7
Instruction ID: cdbc1a8bb76e1a2a5b282f703e6d753348d0c213b96938f0aa8c57714b91c246
Opcode Fuzzy Hash: 64cf166d82de8a797ffdfc4fb0a1708a697c15c3db9a868427a266cb2015acd7
Instruction Fuzzy Hash: FF316D71505345AFD320DF64DC88A9BBBE8FF89714F41082EF589D2260E774E904CB66

Uniqueness

Uniqueness Score: -1.00%

Function 007D4070 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 80fileCOMMON

Download Yara Rule

APIs

StrRChrW.SHLWAPI(008E8DE8,00000000,0000005C,?,?,?,007D54A3), ref: 007D408A
SHCreateDirectoryExW.SHELL32(00000000,008E8DE8,00000000,?,?,?,007D54A3), ref: 007D40A2
PathFileExistsW.SHLWAPI(008E8DE8,?,?,?,007D54A3), ref: 007D40B5
PathIsDirectoryW.SHLWAPI(008E8DE8), ref: 007D40C4
CreateFileW.KERNEL32(008E8DE8,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,007D54A3), ref: 007D40E3
GetFileSize.KERNEL32(00000000,?), ref: 007D40FE
CloseHandle.KERNEL32(00000000), ref: 007D4107
CreateFileW.KERNEL32(008E8DE8,40000000,00000003,00000000,00000002,00000080,00000000,?,?,?,007D54A3), ref: 007D4131
CloseHandle.KERNEL32(00000000,?,?,?,007D54A3), ref: 007D413D

Strings

minipath, xrefs: 007D4147

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: File$Create$CloseDirectoryHandlePath$ExistsSize
String ID: minipath
API String ID: 3237904083-3157150768
Opcode ID: 04ba3b13ce92b058a911fc78b51aefa266f7929ba1d11658b648bbafa98e1d7f
Instruction ID: 91dc8b604bfcad1caaf9c614f3b6c07621341928008bbaccb8c49b6cfd6afbf0
Opcode Fuzzy Hash: 04ba3b13ce92b058a911fc78b51aefa266f7929ba1d11658b648bbafa98e1d7f
Instruction Fuzzy Hash: E521B035740310BBF2301B69EC0AF5A6668FF51F62F240126FA59F73D0EBF458948665

Uniqueness

Uniqueness Score: -1.00%

Function 007E1DE0 Relevance: 16.6, APIs: 11, Instructions: 77windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000064), ref: 007E1E1F
GetWindowTextLengthW.USER32(00000000), ref: 007E1E22
GetDlgItem.USER32(?,00000001), ref: 007E1E2F
EnableWindow.USER32(00000000), ref: 007E1E32
SetWindowLongW.USER32(?,00000008,?), ref: 007E1E94
SendMessageW.USER32(?,00000080,00000000,?), ref: 007E1EAC
SendDlgItemMessageW.USER32(?,00000064,000000C5,00000103,00000000), ref: 007E1EC1

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ItemWindow$MessageSend$EnableLengthLongText
String ID:
API String ID: 944039030-0
Opcode ID: 67a95d26941177b52d961583173fa6aa9c2484ad614565ab3632d7aede531958
Instruction ID: 5bff1673bf20f8494bef82143037acd98427c23022aaad5482808551f3c643f5
Opcode Fuzzy Hash: 67a95d26941177b52d961583173fa6aa9c2484ad614565ab3632d7aede531958
Instruction Fuzzy Hash: 4B21E7366413107BE7205B28EC0EF9B3B64FB49711F018801FA81EA1E0D7B5EC91CB51

Uniqueness

Uniqueness Score: -1.00%

Function 007DDA00 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 93stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?,0085D420), ref: 007DDA5D
LoadStringW.USER32(00002AFF,?,00000100), ref: 007DDA74
LoadStringW.USER32(00002AFF,?,00000100), ref: 007DDA8F
lstrcpyW.KERNEL32(?,?), ref: 007DDAA8
GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?), ref: 007DDABD
SHBrowseForFolderW.SHELL32 ref: 007DDB07
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 007DDB15
CoTaskMemFree.OLE32(00000000), ref: 007DDB1C

Strings

A, xrefs: 007DDAEF

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: LoadStringlstrcpy$BrowseCurrentDirectoryFolderFreeFromListPathTask
String ID: A
API String ID: 2100424654-3554254475
Opcode ID: f7dbfdace37f18cc443c4dcc00ca70673f9768aeb6a51c8f5eda9c9331e1b2e9
Instruction ID: 82cc340f6c77446e787477c4fe4e6cc702095e0365ef8ad693acec68f6ee3f85
Opcode Fuzzy Hash: f7dbfdace37f18cc443c4dcc00ca70673f9768aeb6a51c8f5eda9c9331e1b2e9
Instruction Fuzzy Hash: 873163B55043449FD320DF50DC49B9BB7E8FB88714F40482AF689C7251E7B8A944CB96

Uniqueness

Uniqueness Score: -1.00%

Function 007E6640 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 59stringCOMMON

Download Yara Rule

APIs

lstrcmpW.KERNEL32(?,0085E2D8,0000C356,775DF670,007EF8E3,?), ref: 007E6650
lstrcmpW.KERNEL32(?,0085E2E0), ref: 007E665C
lstrcmpW.KERNEL32(?,0085E2D8), ref: 007E6668
PathIsRootW.SHLWAPI(008EBF0C), ref: 007E6673
lstrcpynW.KERNEL32(?,*.*,00000104), ref: 007E668B
SearchPathW.KERNEL32(008EBF0C,?,00000000,00000104,?,00000000), ref: 007E66B4
SearchPathW.KERNEL32(C:\Users\user\Documents,?,00000000,00000104,?,00000000), ref: 007E66CE

Strings

*.*, xrefs: 007E6682
C:\Users\user\Documents, xrefs: 007E66C9

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Pathlstrcmp$Search$Rootlstrcpyn
String ID: *.*$C:\Users\user\Documents
API String ID: 2623810893-4095852576
Opcode ID: 7b08e08cfdbdde944c14f2ec9589f02bba235357b0e162bfe7f6418d3103d0de
Instruction ID: c1e32197d60b9d6003e571b75b9599c1d5763d2b5b5714e34154762deae52ade
Opcode Fuzzy Hash: 7b08e08cfdbdde944c14f2ec9589f02bba235357b0e162bfe7f6418d3103d0de
Instruction Fuzzy Hash: C001FC713813527BEB1417266C0AF6F269CFF92B95F050424F900E13C4DFE8DC418569

Uniqueness

Uniqueness Score: -1.00%

Function 007E0410 Relevance: 15.1, APIs: 10, Instructions: 132stringwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 007E3CE0: SendMessageW.USER32(?,00001032,00000000,00000000), ref: 007E3D18
Part of subcall function 007E3CE0: SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 007E3D28
Part of subcall function 007E3CE0: SendMessageW.USER32(?,?,?,0000104B), ref: 007E3D4D

Part of subcall function 007E64F0: lstrlenW.KERNEL32(?,?,?,007DE260), ref: 007E64F5
Part of subcall function 007E64F0: CharPrevW.USER32(?,?,?,?,007DE260), ref: 007E6512
Part of subcall function 007E64F0: CharPrevW.USER32(?,?,?,?,?,007DE260), ref: 007E651C

lstrcpyW.KERNEL32(?,00000000), ref: 007E0476

Part of subcall function 007E7A20: FindResourceW.KERNEL32(00000000,?,00000005,?,?), ref: 007E7A37
Part of subcall function 007E7A20: LoadResource.KERNEL32(00000000,00000000), ref: 007E7A4A
Part of subcall function 007E7A20: LockResource.KERNEL32(00000000), ref: 007E7A5B
Part of subcall function 007E7A20: SizeofResource.KERNEL32(00000000,00000000), ref: 007E7A6E
Part of subcall function 007E7A20: LocalAlloc.KERNEL32(00000040,00000040), ref: 007E7A84
Part of subcall function 007E7A20: FreeResource.KERNEL32(00000000), ref: 007E7AA0
Part of subcall function 007E7A20: lstrlenW.KERNEL32(?), ref: 007E7B1D

DialogBoxIndirectParamW.USER32(?,00000000,?,Function_000102C0,?), ref: 007E049A
LocalFree.KERNEL32(00000000,?,Function_000102C0,?), ref: 007E04A7
lstrcpyW.KERNEL32(?,?), ref: 007E0503
lstrcatW.KERNEL32(?,?), ref: 007E0526
lstrcpyW.KERNEL32(?,?), ref: 007E056A
lstrcpyW.KERNEL32(?,?), ref: 007E057C
SHFileOperationW.SHELL32(?,?,?,?,?,Function_000102C0,?), ref: 007E0583
SendMessageW.USER32(?,00000111,00019D0D,00000000), ref: 007E05AD
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000200), ref: 007E05CC

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Resource$MessageSendlstrcpy$CharFileFreeLocalPrevlstrlen$AllocDialogFindIndirectInfoLoadLockOperationParamSizeoflstrcat
String ID:
API String ID: 606905921-0
Opcode ID: 78901d03eff1505a78d7cc709abdf168f698460663d6e22dae20389a9ae65d86
Instruction ID: 24faaa8a7524ba45dabd0eb5a2a7242a828170e7034990b1c76906ba7fdf804d
Opcode Fuzzy Hash: 78901d03eff1505a78d7cc709abdf168f698460663d6e22dae20389a9ae65d86
Instruction Fuzzy Hash: 984152B25053889BD320DBA4DC89FDF73ECBB89314F00092AF659D7181EB74E6448B96

Uniqueness

Uniqueness Score: -1.00%

Function 007E5A70 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 142windowstringCOMMON

Download Yara Rule

APIs

lstrcpynW.KERNEL32(?,?,000001FE,44000000,?,75B03760), ref: 007E5AB4

Part of subcall function 007E6380: CharNextW.USER32(?,?,775DF670,?,007DF938), ref: 007E63A1
Part of subcall function 007E6380: lstrlenW.KERNEL32(?,?,775DF670,?,007DF938), ref: 007E63B2
Part of subcall function 007E6380: lstrlenW.KERNEL32(?,?,?,007DF938), ref: 007E63C7
Part of subcall function 007E6380: CharPrevW.USER32(?,00000000,?,?,007DF938), ref: 007E63D4
Part of subcall function 007E6380: CharPrevW.USER32(?,00000000,?,?,007DF938), ref: 007E63E7

lstrlenW.KERNEL32(00000000,?,?,?,?,75B03760), ref: 007E5AE2
SendMessageW.USER32(?,00000418,00000000,00000000), ref: 007E5B21
SendMessageW.USER32(?,00000416,00000000,00000000), ref: 007E5B3A
SendMessageW.USER32(?,00000444,00000001,008E71F4), ref: 007E5BC8
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,75B03760), ref: 007E5BCB
SendMessageW.USER32(?,00000418,00000000,00000000), ref: 007E5BE3

Strings

, xrefs: 007E5B43

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MessageSendlstrlen$Char$Prev$Nextlstrcpyn
String ID:
API String ID: 1478935676-3916222277
Opcode ID: c26cfd49a3a5f420c1a978eea2bdd7bb350998a5a66c088c6541db59c8ee6dfd
Instruction ID: 5c1f91563900c2d8fda2298338e9822fe19de26dc86780f973e58430e6ebc5f2
Opcode Fuzzy Hash: c26cfd49a3a5f420c1a978eea2bdd7bb350998a5a66c088c6541db59c8ee6dfd
Instruction Fuzzy Hash: 6C4117B2941718A7D720DB51DC46F6B7398EF54704F100829FB04E7192E6BCE98986E6

Uniqueness

Uniqueness Score: -1.00%

Function 007D3560 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(008E8DE8,C0000000,00000003,00000000,00000004,00000080,00000000), ref: 007D35C1
LockFileEx.KERNEL32(00000000,00000002,00000000,000000FF,00000000,?), ref: 007D35E0
FlushFileBuffers.KERNEL32(?,?,?,minipath,?,?,00000000,00000001,00000001), ref: 007D3665
UnlockFileEx.KERNEL32(?,00000000,000000FF,00000000,?,?,?,?,minipath,?,?,00000000,00000001,00000001), ref: 007D3677
CloseHandle.KERNEL32(?,?,00000000,000000FF,00000000,?,?,?,?,minipath,?,?,00000000,00000001,00000001), ref: 007D367E

Strings

minipath, xrefs: 007D363E
AcquireWriteFileLock(): INVALID FILE HANDLE!, xrefs: 007D36A9
AcquireWriteFileLock(): NO EXCLUSIVE LOCK ACQUIRED!, xrefs: 007D35F3

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: File$BuffersCloseCreateFlushHandleLockUnlock
String ID: AcquireWriteFileLock(): INVALID FILE HANDLE!$AcquireWriteFileLock(): NO EXCLUSIVE LOCK ACQUIRED!$minipath
API String ID: 3886186091-1287712860
Opcode ID: b2c9a5867a9af675bc026d7dbdc6e88808c4a013768bdc04474bcfe054da8dad
Instruction ID: daeef3148d189bccac06874b877c389999bc06fb77c3a51fd0e26670d655032f
Opcode Fuzzy Hash: b2c9a5867a9af675bc026d7dbdc6e88808c4a013768bdc04474bcfe054da8dad
Instruction Fuzzy Hash: 5F314C31A0431077D63067289C45F6E76B4EB81B70F14032BFD65A63D0D668DE8DC693

Uniqueness

Uniqueness Score: -1.00%

Function 007D3A70 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(008E8DE8,C0000000,00000003,00000000,00000004,00000080,00000000), ref: 007D3ACF
LockFileEx.KERNEL32(00000000,00000002,00000000,000000FF,00000000,?), ref: 007D3AEE
FlushFileBuffers.KERNEL32(?,?,?,?,SaveSettings,?), ref: 007D3B5E
UnlockFileEx.KERNEL32(?,00000000,000000FF,00000000,?,?,?,?,?,SaveSettings,?), ref: 007D3B70
CloseHandle.KERNEL32(?,?,00000000,000000FF,00000000,?,?,?,?,?,SaveSettings,?), ref: 007D3B77

Strings

SaveSettings, xrefs: 007D3B41
AcquireWriteFileLock(): INVALID FILE HANDLE!, xrefs: 007D3BA2
AcquireWriteFileLock(): NO EXCLUSIVE LOCK ACQUIRED!, xrefs: 007D3AFD

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: File$BuffersCloseCreateFlushHandleLockUnlock
String ID: AcquireWriteFileLock(): INVALID FILE HANDLE!$AcquireWriteFileLock(): NO EXCLUSIVE LOCK ACQUIRED!$SaveSettings
API String ID: 3886186091-4113319956
Opcode ID: 6497360ad58d36aae56cc25de2540b6fcf4e71ea959f43de3320c63187849603
Instruction ID: 1924a0b1bc7d6241edba447e57305b1437890215c9e3a282a99b71423c29f625
Opcode Fuzzy Hash: 6497360ad58d36aae56cc25de2540b6fcf4e71ea959f43de3320c63187849603
Instruction Fuzzy Hash: C1312872A44210A7D23067289C49F6E76B4FB81770F14432BFDB5A62D0DABC5E498693

Uniqueness

Uniqueness Score: -1.00%

Function 007E72B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103stringmemorywindowCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000268), ref: 007E72D3
lstrcpynW.KERNEL32(00000000,Copy/Move MRU,00000100), ref: 007E7304
lstrcpynW.KERNEL32(?,?,00000104), ref: 007E736D
lstrlenW.KERNEL32(?), ref: 007E7378
SendMessageW.USER32(00000143,00000143,00000000,?), ref: 007E738E
LocalFree.KERNEL32(00000000), ref: 007E73AD
LocalFree.KERNEL32(?), ref: 007E73CD

Strings

Copy/Move MRU, xrefs: 007E72FE

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Local$Freelstrcpyn$AllocMessageSendlstrlen
String ID: Copy/Move MRU
API String ID: 876074594-4109381532
Opcode ID: 254585053bfecf3d9869ba6a200cd0a595e5d5abf58a4dcb2ef72ac1c34e0160
Instruction ID: 70ceeeaf46c969becdfec91ba9fca1af3d7ea48e62a72404ea1a534575f65ee9
Opcode Fuzzy Hash: 254585053bfecf3d9869ba6a200cd0a595e5d5abf58a4dcb2ef72ac1c34e0160
Instruction Fuzzy Hash: 89315731649385EBE728DF14DC8AB9B7794FF59300F140029FD45AB281EB78E804CB91

Uniqueness

Uniqueness Score: -1.00%

Function 007ECC5D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 86windowCOMMON

Download Yara Rule

APIs

MessageBeep.USER32(00000000), ref: 007EC0CC
SendMessageW.USER32(00001032,00000000,00000000), ref: 007ECC72
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 007ECC8C
SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 007ECCA0
SendMessageW.USER32 ref: 007ECCCF
GetParent.USER32(?), ref: 007ECCFB
GetParent.USER32(?), ref: 007ECD1B

Strings

$, xrefs: 007ECD0F

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Message$Send$Parent$Beep
String ID: $
API String ID: 3721797063-3993045852
Opcode ID: 9aa58764e08aac4bfb34ba7d87d0f77f42a71314a7a0aed68aac6ce27fbf2bb4
Instruction ID: 051b87357f8a7e9a98a7dd206ffa75df32a430d2010b7653b6aaf825e4ca70f3
Opcode Fuzzy Hash: 9aa58764e08aac4bfb34ba7d87d0f77f42a71314a7a0aed68aac6ce27fbf2bb4
Instruction Fuzzy Hash: E4315AB0248345AFE320CF11CC85B5BBBE8FB88754F004919F6999B2E1DBB5E8458B51

Uniqueness

Uniqueness Score: -1.00%

Function 007D4320 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 85stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007D33B0: lstrlenW.KERNEL32(?,?), ref: 007D3516

Part of subcall function 007D4160: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,75A94E60,775DF670,?,75A9A6C0), ref: 007D418A
Part of subcall function 007D4160: PathIsRelativeW.SHLWAPI(?,?,75A9A6C0), ref: 007D4198
Part of subcall function 007D4160: lstrcpyW.KERNEL32(?,?), ref: 007D41B2
Part of subcall function 007D4160: PathFindFileNameW.SHLWAPI(?,?,?,75A9A6C0), ref: 007D41C1
Part of subcall function 007D4160: lstrcpyW.KERNEL32(00000000), ref: 007D41C8
Part of subcall function 007D4160: PathFileExistsW.KERNELBASE(?,?,75A9A6C0), ref: 007D41CF
Part of subcall function 007D4160: PathIsDirectoryW.SHLWAPI(?), ref: 007D41E4
Part of subcall function 007D4160: lstrcpyW.KERNEL32(?,?), ref: 007D41F4
Part of subcall function 007D4160: PathRemoveFileSpecW.SHLWAPI(?,?,75A9A6C0), ref: 007D41FB
Part of subcall function 007D4160: lstrcatW.KERNEL32(?,\np3\), ref: 007D4211
Part of subcall function 007D4160: lstrcatW.KERNEL32(?,?), ref: 007D4220
Part of subcall function 007D4160: PathFileExistsW.KERNELBASE(?,?,75A9A6C0), ref: 007D4227
Part of subcall function 007D4160: PathIsDirectoryW.SHLWAPI(?), ref: 007D4236
Part of subcall function 007D4160: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?,?,75A9A6C0), ref: 007D424F
Part of subcall function 007D4160: PathAppendW.SHLWAPI(?,?,?,75A9A6C0), ref: 007D4262
Part of subcall function 007D4160: PathFileExistsW.KERNELBASE(?,?,75A9A6C0), ref: 007D426D
Part of subcall function 007D4160: PathIsDirectoryW.SHLWAPI(?), ref: 007D427C

lstrcpyW.KERNEL32(?,?), ref: 007D437D
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,?,?,75A94E60,775DF670), ref: 007D43B1
PathIsRelativeW.SHLWAPI(?,?,?,75A94E60,775DF670), ref: 007D43BF
lstrcpyW.KERNEL32(?,?), ref: 007D43D1
PathFindFileNameW.SHLWAPI(?,?,?,?,75A94E60,775DF670), ref: 007D43DC
lstrcpyW.KERNEL32(00000000), ref: 007D43E3

Strings

minipath.ini, xrefs: 007D4353

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Path$Filelstrcpy$DirectoryExists$EnvironmentExpandFindNameRelativeStringslstrcat$AppendFolderRemoveSpeclstrlen
String ID: minipath.ini
API String ID: 785113118-2848199397
Opcode ID: d94ca9980658da2a7d6c9cf3087eb130dd54dca6609f066329b27822b099a090
Instruction ID: 868901c796a73436561062fdcfb1b43a4c9032f561949923b5ff27ba004d7d64
Opcode Fuzzy Hash: d94ca9980658da2a7d6c9cf3087eb130dd54dca6609f066329b27822b099a090
Instruction Fuzzy Hash: 0F2182B66042189BD720DB64DC85BFF73ECBBD8300F44043EB619C3251EA7895898763

Uniqueness

Uniqueness Score: -1.00%

Function 007ED049 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 81stringwindowCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(?,008ED39C), ref: 007ED056

Part of subcall function 007E7A20: FindResourceW.KERNEL32(00000000,?,00000005,?,?), ref: 007E7A37
Part of subcall function 007E7A20: LoadResource.KERNEL32(00000000,00000000), ref: 007E7A4A
Part of subcall function 007E7A20: LockResource.KERNEL32(00000000), ref: 007E7A5B
Part of subcall function 007E7A20: SizeofResource.KERNEL32(00000000,00000000), ref: 007E7A6E
Part of subcall function 007E7A20: LocalAlloc.KERNEL32(00000040,00000040), ref: 007E7A84
Part of subcall function 007E7A20: FreeResource.KERNEL32(00000000), ref: 007E7AA0
Part of subcall function 007E7A20: lstrlenW.KERNEL32(?), ref: 007E7B1D

DialogBoxIndirectParamW.USER32(?,00000000,?,Function_0000FEA0,00000000), ref: 007ED07E
LocalFree.KERNEL32(00000000,?,Function_0000FEA0,00000000), ref: 007ED08B
lstrcmpiW.KERNEL32(008ED39C,?,?,Function_0000FEA0,00000000), ref: 007ED0A7
SendMessageW.USER32(?,00000111,00019D0D,00000000), ref: 007ED0FB
SendMessageW.USER32(00001013,00000000,00000000,00000000), ref: 007ED12F
lstrcmpW.KERNEL32(008ED39C,*.*,?,Function_0000FEA0,00000000), ref: 007ED13B

Strings

*.*, xrefs: 007ED131

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Resource$FreeLocalMessageSend$AllocDialogFindIndirectLoadLockParamSizeoflstrcmplstrcmpilstrcpylstrlen
String ID: *.*
API String ID: 773039121-438819550
Opcode ID: 573b35057302aaa5f06488599cfba0e508c7cbe0ce1263947ae3ef53e4d34d60
Instruction ID: 3707277df2447c6fff047f5f564c887958221920b3213cd3bbc590c51d2d176d
Opcode Fuzzy Hash: 573b35057302aaa5f06488599cfba0e508c7cbe0ce1263947ae3ef53e4d34d60
Instruction Fuzzy Hash: 272127756013C5ABE730AB22EC4ABAB73A8FB49314F050435F508D72A1E7BDAC44C762

Uniqueness

Uniqueness Score: -1.00%

Function 007E7580 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 80COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 007E760D
EnumFontsW.GDI32(00000000,Segoe UI,Function_00017510,?), ref: 007E7621
ReleaseDC.USER32(00000000,00000000), ref: 007E762A

Strings

Segoe UI, xrefs: 007E75F2, 007E761F
Microsoft JhengHei UI, xrefs: 007E75BD, 007E75D3
Microsoft YaHei UI, xrefs: 007E75C4, 007E75DA
Malgun Gothic, xrefs: 007E75EB
Yu Gothic UI, xrefs: 007E75E4

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: EnumFontsRelease
String ID: Malgun Gothic$Microsoft JhengHei UI$Microsoft YaHei UI$Segoe UI$Yu Gothic UI
API String ID: 2694381407-2688067338
Opcode ID: 9579e8dab81659a134e0746dd8463a6806091e049dafddc029f767ff80f9c90d
Instruction ID: 6647059a2ec6b3f74bc5bab1a685f35fc12c02dc3afb852f5e262917dc320542
Opcode Fuzzy Hash: 9579e8dab81659a134e0746dd8463a6806091e049dafddc029f767ff80f9c90d
Instruction Fuzzy Hash: F921347430A3918BD71C4A6E8C9476A7295FF89316F640569FE02CB790E728CD18C351

Uniqueness

Uniqueness Score: -1.00%

Function 007E4460 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000200B,00000000,Explorer), ref: 007E448F
SendMessageW.USER32(?,00000155,00000001,00000000), ref: 007E449B
SHGetFileInfoW.SHELL32(C:\,00000000,?,000002B4,00004001), ref: 007E44C7
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 007E44D6
SendMessageW.USER32(?,0000040E,00000008,00000008), ref: 007E44E2
SendMessageW.USER32(?,0000040E,00000020,00000020), ref: 007E44EE

Strings

Explorer, xrefs: 007E4482
C:\, xrefs: 007E44C2

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MessageSend$FileInfo
String ID: C:\$Explorer
API String ID: 521633743-4050850895
Opcode ID: 80e2749e5f41ed506ec23b8e7906ef6f7848ea9e0eccb1e1b6e409ff6073b3e1
Instruction ID: 15cab78bc0e2444cefa3f1aa38afe72590991229c5727d5a78cc9ab82339339f
Opcode Fuzzy Hash: 80e2749e5f41ed506ec23b8e7906ef6f7848ea9e0eccb1e1b6e409ff6073b3e1
Instruction Fuzzy Hash: 17014F717C071476F231AB549C8BF7E3B68AB85F11F40441ABB18BE2C1D7F864458A96

Uniqueness

Uniqueness Score: -1.00%

Function 007E7A20 Relevance: 13.7, APIs: 9, Instructions: 180stringmemoryCOMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,?,00000005,?,?), ref: 007E7A37
LoadResource.KERNEL32(00000000,00000000), ref: 007E7A4A
LockResource.KERNEL32(00000000), ref: 007E7A5B
SizeofResource.KERNEL32(00000000,00000000), ref: 007E7A6E
LocalAlloc.KERNEL32(00000040,00000040), ref: 007E7A84
FreeResource.KERNEL32(00000000), ref: 007E7AA0
lstrlenW.KERNEL32(?), ref: 007E7B1D
lstrlenW.KERNEL32(?), ref: 007E7B89
FreeResource.KERNEL32(00000000), ref: 007E7C1A

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Resource$Freelstrlen$AllocFindLoadLocalLockSizeof
String ID:
API String ID: 2547741363-0
Opcode ID: 196b7f99c6ed862ddb042df308f391768707dd4283f49ea239485842b077d0c9
Instruction ID: e3df69d2234397c265545b5d99d8e3e07aaf2dde62de498c5357108cb5949def
Opcode Fuzzy Hash: 196b7f99c6ed862ddb042df308f391768707dd4283f49ea239485842b077d0c9
Instruction Fuzzy Hash: 7051FBB56093418BD724AF29DC85B2BB7E8FF99704F040929F94687390E738DD04CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 007EC8F1 Relevance: 13.6, APIs: 9, Instructions: 104windowstringsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 007E3CE0: SendMessageW.USER32(?,00001032,00000000,00000000), ref: 007E3D18
Part of subcall function 007E3CE0: SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 007E3D28
Part of subcall function 007E3CE0: SendMessageW.USER32(?,?,?,0000104B), ref: 007E3D4D

lstrcpyW.KERNEL32(?,?), ref: 007EC95E
SHFileOperationW.SHELL32(?), ref: 007EC9C8
WaitForSingleObject.KERNEL32(00000000), ref: 007EC9D6
SendMessageW.USER32(?,00000111,00019D0D,00000000), ref: 007EC9F6
SendMessageW.USER32(00001004,00000000,00000000), ref: 007ECA0C
SendMessageW.USER32(00001004,00000000,00000000), ref: 007ECA22
SendMessageW.USER32(0000102B,00000000,?), ref: 007ECA51
SendMessageW.USER32(00001013,00000000,00000000), ref: 007ECA61
FindNextChangeNotification.KERNEL32 ref: 007ECA69

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MessageSend$ChangeFileFindNextNotificationObjectOperationSingleWaitlstrcpy
String ID:
API String ID: 1797783416-0
Opcode ID: 1087bb29f22e69a21552b5d280a3a1417bd80756f97e3321969ddd96d7e93e41
Instruction ID: ab5c2211993ce94ee1e2b924fd14bc1e943b29bd0fbf2f99a7637f521a2de7c3
Opcode Fuzzy Hash: 1087bb29f22e69a21552b5d280a3a1417bd80756f97e3321969ddd96d7e93e41
Instruction Fuzzy Hash: E3411375505384AAE7309B21DC88FDB77E8FB88710F144619F288AB1E0D7B8A884CF56

Uniqueness

Uniqueness Score: -1.00%

Function 02AE01F3 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 273COMMON

Download Yara Rule

APIs

Part of subcall function 02ADFEAC: CreateFileW.KERNEL32(?,00000000,?,02AE029C,?,?,00000000,?,02AE029C,?,0000000C), ref: 02ADFEC9

GetLastError.KERNEL32 ref: 02AE0307
GetFileType.KERNEL32(00000000), ref: 02AE031A
GetLastError.KERNEL32 ref: 02AE0324
CloseHandle.KERNEL32(00000000), ref: 02AE034D
CloseHandle.KERNEL32(02AD79E3), ref: 02AE049A
GetLastError.KERNEL32 ref: 02AE04CC

Strings

H, xrefs: 02AE0458

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: ErrorLast$CloseFileHandle$CreateType
String ID: H
API String ID: 3086256261-2852464175
Opcode ID: 299fcb13d9c740b689d29778e1e9e0c0e3d24a08b6593b87556c2f25e9325d5f
Instruction ID: c4c3b4224152aa04a63237a3010965eb82a935dfc90f5f4894741bd7aa94d9b4
Opcode Fuzzy Hash: 299fcb13d9c740b689d29778e1e9e0c0e3d24a08b6593b87556c2f25e9325d5f
Instruction Fuzzy Hash: 90A13432A542099FCF199F68D890BAE7BB1AF06314F14018EE812EF391DF758817CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02A92220 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 131COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 02A9225A
GetLastError.KERNEL32(0000000A), ref: 02A92285

Strings

Timer: QueryPerformanceCounter failed with error , xrefs: 02A922A0
vg~, xrefs: 02A92296, 02A92384, 02A922A5, 02A92390
Timer: QueryPerformanceFrequency failed with error , xrefs: 02A9238B

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: CounterErrorLastPerformanceQuery
String ID: Timer: QueryPerformanceCounter failed with error $Timer: QueryPerformanceFrequency failed with error $vg~
API String ID: 1297246462-3077413103
Opcode ID: 50f661596ba61c5d1c6182c041c5513a89e7ffb3562bce21fce70f16037a2276
Instruction ID: 45312984a341ad80a0c0f888949c387fa881c9a83943abbb8e8d518133b5a939
Opcode Fuzzy Hash: 50f661596ba61c5d1c6182c041c5513a89e7ffb3562bce21fce70f16037a2276
Instruction Fuzzy Hash: 8C4170B1D80308EBEB11DFE4D948BAEB7B9FB04704F404659E91AA7281DF74A505CF51

Uniqueness

Uniqueness Score: -1.00%

Function 007D3BC0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000004,00000080,00000000), ref: 007D3C1A
LockFileEx.KERNEL32(00000000,00000002,00000000,000000FF,00000000,?,?,?,C0000000,00000003,00000000,00000004,00000080,00000000), ref: 007D3C3A
FlushFileBuffers.KERNEL32(?,?,?,?,?,?,?,?,?,C0000000,00000003,00000000,00000004,00000080,00000000), ref: 007D3CA8
UnlockFileEx.KERNEL32(?,00000000,000000FF,00000000,?,?,?,?,?,?,?,?,?,?,C0000000,00000003), ref: 007D3CBA
CloseHandle.KERNEL32(?,?,00000000,000000FF,00000000,?,?,?,?,?,?,?,?,?,?,C0000000), ref: 007D3CC1

Part of subcall function 007E2F30: GetLastError.KERNEL32(?,00000000,?,?,007D2773), ref: 007E2F39
Part of subcall function 007E2F30: FormatMessageW.KERNEL32 ref: 007E2F63
Part of subcall function 007E2F30: lstrlenW.KERNEL32(00000000,00000000,008E8DE8), ref: 007E2F7A
Part of subcall function 007E2F30: lstrlenW.KERNEL32(00000000), ref: 007E2F82
Part of subcall function 007E2F30: LocalAlloc.KERNEL32(00000040,00000000), ref: 007E2F92
Part of subcall function 007E2F30: GetFocus.USER32 ref: 007E2FBF
Part of subcall function 007E2F30: MessageBoxExW.USER32(?,00000000,MiniPath - ERROR,00000010,?), ref: 007E2FDA
Part of subcall function 007E2F30: LocalFree.KERNEL32(00000000,?,?,007D2773), ref: 007E2FE1
Part of subcall function 007E2F30: LocalFree.KERNEL32(?), ref: 007E2FE7

Strings

AcquireWriteFileLock(): INVALID FILE HANDLE!, xrefs: 007D3CEC
AcquireWriteFileLock(): NO EXCLUSIVE LOCK ACQUIRED!, xrefs: 007D3C49

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: File$Local$FreeMessagelstrlen$AllocBuffersCloseCreateErrorFlushFocusFormatHandleLastLockUnlock
String ID: AcquireWriteFileLock(): INVALID FILE HANDLE!$AcquireWriteFileLock(): NO EXCLUSIVE LOCK ACQUIRED!
API String ID: 3792989122-250906885
Opcode ID: d54e7d318024917a08ea11b16c17301e23be96ae868fc74d280ebb185edd208f
Instruction ID: b8e9e79d01de9dcdb0e01dfe519eec3fbf64dd2fbd95362e9e02bf1843631529
Opcode Fuzzy Hash: d54e7d318024917a08ea11b16c17301e23be96ae868fc74d280ebb185edd208f
Instruction Fuzzy Hash: 99312D3291422157D33067289C49B7EB3B8BB85760F05431BFDA9B63D0DAA85E49C6A3

Uniqueness

Uniqueness Score: -1.00%

Function 007D15C0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 110windowCOMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,?), ref: 007D16CC

Part of subcall function 007D19E0: SystemParametersInfoW.USER32(00000042,0000000C,00000000), ref: 007D1A11

SendMessageW.USER32(?,0000111E,00000000,?), ref: 007D1656
SendMessageW.USER32(?,0000111D,00000000,?), ref: 007D167D
RedrawWindow.USER32(?,00000000,00000000,00000407), ref: 007D1694
#413.COMCTL32(?,?,?,?), ref: 007D16A2
#413.COMCTL32(?,?,?,?), ref: 007D16FA

Strings

ItemsView, xrefs: 007D1618

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: #413MessageSend$ColorInfoParametersRedrawSystemTextWindow
String ID: ItemsView
API String ID: 2992698940-272564461
Opcode ID: 42bfb6ff76f0ebedd5c807c28c04001ef843b3a99da7157f005da7cbd0c67e1d
Instruction ID: f7ae0fae9409e9ae0320594b648165b35b17c3f30df08f355996b8f9399a59d5
Opcode Fuzzy Hash: 42bfb6ff76f0ebedd5c807c28c04001ef843b3a99da7157f005da7cbd0c67e1d
Instruction Fuzzy Hash: 17315632244345BBE3209BA8EC49F8BBF78FB99724F040416F304A52A1C7B5E900CB65

Uniqueness

Uniqueness Score: -1.00%

Function 007D1710 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 110windowCOMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,?), ref: 007D181C

Part of subcall function 007D19E0: SystemParametersInfoW.USER32(00000042,0000000C,00000000), ref: 007D1A11

SendMessageW.USER32(?,0000111E,00000000,?), ref: 007D17A6
SendMessageW.USER32(?,0000111D,00000000,?), ref: 007D17CD
RedrawWindow.USER32(?,00000000,00000000,00000407), ref: 007D17E4
#413.COMCTL32(?,?,?,?), ref: 007D17F2
#413.COMCTL32(?,?,?,?), ref: 007D184A

Strings

ItemsView, xrefs: 007D1768

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: #413MessageSend$ColorInfoParametersRedrawSystemTextWindow
String ID: ItemsView
API String ID: 2992698940-272564461
Opcode ID: 59a3aa876f919ea7b278e41d401558bc68290c2fdf27edd5de31e4ac2e982be1
Instruction ID: 4f1bcdcde4c95669f17f8d0ebc5f2a535c8a919f1601f2aeaa7ce4384b752f17
Opcode Fuzzy Hash: 59a3aa876f919ea7b278e41d401558bc68290c2fdf27edd5de31e4ac2e982be1
Instruction Fuzzy Hash: 77315932244349BFE3219FA4DC89F9BBF78FB49765F040416F704A92A1C766D900D726

Uniqueness

Uniqueness Score: -1.00%

Function 007E5670 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 007E5699
GetParent.USER32(?), ref: 007E569C
GetWindowRect.USER32(00000000,?), ref: 007E56A8
MonitorFromRect.USER32(?,00000002), ref: 007E56B1
GetMonitorInfoW.USER32(00000000,?), ref: 007E56C5
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005), ref: 007E5757

Strings

(, xrefs: 007E56BB

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: RectWindow$Monitor$FromInfoParent
String ID: (
API String ID: 2534694491-3887548279
Opcode ID: d0e6103c854e4980a6e17186e73f8f9823c538a55a10d77e8ed7eb0c8b6af3c2
Instruction ID: b73cf7db1ed21340cf0059cdaaf4578cc567f2b619cee1aebd69f44131bd25f6
Opcode Fuzzy Hash: d0e6103c854e4980a6e17186e73f8f9823c538a55a10d77e8ed7eb0c8b6af3c2
Instruction Fuzzy Hash: 79318C752053459FC700CF68CC89A2EBBE9FB88708F54492DF585D3251E670F908CB92

Uniqueness

Uniqueness Score: -1.00%

Function 007E73F0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 93stringmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000268), ref: 007E7413
lstrcpynW.KERNEL32(00000000,Copy/Move MRU,00000100), ref: 007E744E
lstrcmpiW.KERNEL32(00000000), ref: 007E748D
lstrcmpW.KERNEL32(00000000), ref: 007E7495
LocalFree.KERNEL32(?), ref: 007E74B4
StrDupW.SHLWAPI ref: 007E74E2

Strings

Copy/Move MRU, xrefs: 007E7448

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Local$AllocFreelstrcmplstrcmpilstrcpyn
String ID: Copy/Move MRU
API String ID: 3287565185-4109381532
Opcode ID: 87c187642be20e4fdbc90b544ff02de38901ac157dcc0f109f8b57baa60cd16a
Instruction ID: ff9c0f8348e2476dd1e6202c46b795d9bb08125647ee07728d08c85a70e6083c
Opcode Fuzzy Hash: 87c187642be20e4fdbc90b544ff02de38901ac157dcc0f109f8b57baa60cd16a
Instruction Fuzzy Hash: 03316C35705792DBC715DF15EC84B6ABBB0FF8A701F004119FD4157291DB78A809CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 007E4810 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000146,00000000,00000000), ref: 007E4842
SendMessageW.USER32(?,0000040D,00000000,00000020), ref: 007E4871
StrRetToBufW.SHLWAPI(?,75B03760,?,00000040), ref: 007E48A3
PathIsSameRootW.SHLWAPI(00000020,?), ref: 007E48B5
SendMessageW.USER32(?,0000014E,00000001,00000000), ref: 007E48D4
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 007E48FA

Strings

, xrefs: 007E4850

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MessageSend$PathRootSame
String ID:
API String ID: 2384681124-3916222277
Opcode ID: 8d57b8f4b5a2b024390f9f28d571cdb04f75cb7192899a5d56ab15bf502a8d29
Instruction ID: b817c7a7cd207ceafb9dd1bf9f09eb87c57516b1b1dd6a819db049833ba19e7f
Opcode Fuzzy Hash: 8d57b8f4b5a2b024390f9f28d571cdb04f75cb7192899a5d56ab15bf502a8d29
Instruction Fuzzy Hash: CE216271245385AFE320DF55DD85FA7B7ECFB89B10F014429F64897190D774E8048B66

Uniqueness

Uniqueness Score: -1.00%

Function 007D28E0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(008E8DE8,C0000000,00000003,00000000,00000004,00000080,00000000), ref: 007D2928
LockFileEx.KERNEL32(00000000,00000002,00000000,000000FF,00000000,?), ref: 007D2947
FlushFileBuffers.KERNEL32(75AF55F0,75AF55F0), ref: 007D299A
UnlockFileEx.KERNEL32(75AF55F0,00000000,000000FF,00000000,?), ref: 007D29AC
CloseHandle.KERNEL32(75AF55F0), ref: 007D29B3

Part of subcall function 007E2F30: GetLastError.KERNEL32(?,00000000,?,?,007D2773), ref: 007E2F39
Part of subcall function 007E2F30: FormatMessageW.KERNEL32 ref: 007E2F63
Part of subcall function 007E2F30: lstrlenW.KERNEL32(00000000,00000000,008E8DE8), ref: 007E2F7A
Part of subcall function 007E2F30: lstrlenW.KERNEL32(00000000), ref: 007E2F82
Part of subcall function 007E2F30: LocalAlloc.KERNEL32(00000040,00000000), ref: 007E2F92
Part of subcall function 007E2F30: GetFocus.USER32 ref: 007E2FBF
Part of subcall function 007E2F30: MessageBoxExW.USER32(?,00000000,MiniPath - ERROR,00000010,?), ref: 007E2FDA
Part of subcall function 007E2F30: LocalFree.KERNEL32(00000000,?,?,007D2773), ref: 007E2FE1
Part of subcall function 007E2F30: LocalFree.KERNEL32(?), ref: 007E2FE7

Strings

AcquireWriteFileLock(): INVALID FILE HANDLE!, xrefs: 007D29C2
AcquireWriteFileLock(): NO EXCLUSIVE LOCK ACQUIRED!, xrefs: 007D2956

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: File$Local$FreeMessagelstrlen$AllocBuffersCloseCreateErrorFlushFocusFormatHandleLastLockUnlock
String ID: AcquireWriteFileLock(): INVALID FILE HANDLE!$AcquireWriteFileLock(): NO EXCLUSIVE LOCK ACQUIRED!
API String ID: 3792989122-250906885
Opcode ID: 1f663f074dae654fad458d11d66133952676fad718725e4e3a977e538d59f613
Instruction ID: e9202e7fe186b585eb2912b0add32d14cc381081850c3a48941e01328122bce6
Opcode Fuzzy Hash: 1f663f074dae654fad458d11d66133952676fad718725e4e3a977e538d59f613
Instruction Fuzzy Hash: B6212B3174030163E33067299C49B6A2168FBD2335F240326FA64F62E1EBE8684B8275

Uniqueness

Uniqueness Score: -1.00%

Function 007D1C70 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80memorylibraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(comctl32.dll,00000000,00000800), ref: 007D1C89
FreeLibrary.KERNEL32(00000000), ref: 007D1CD1
VirtualProtect.KERNEL32(00000000,00000004,00000004,?), ref: 007D1D19
VirtualProtect.KERNEL32(00000000,00000004,?,?), ref: 007D1D3F
FreeLibrary.KERNEL32(00000000), ref: 007D1D43

Strings

comctl32.dll, xrefs: 007D1C80
uxtheme.dll, xrefs: 007D1CB5

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Library$FreeProtectVirtual$Load
String ID: comctl32.dll$uxtheme.dll
API String ID: 2863076735-677055601
Opcode ID: 6ca347b73695632f790b39b0cc0cb36f7ce435d0fe3ee55ce0bd228fdcb2d153
Instruction ID: aa7d3d45f71c5776e168c3b349f36823fe83312b4854843bd696dfdc821cffb9
Opcode Fuzzy Hash: 6ca347b73695632f790b39b0cc0cb36f7ce435d0fe3ee55ce0bd228fdcb2d153
Instruction Fuzzy Hash: AE21D372700341BBEB208B68DC80B6677B9FB40755F48447AEE5997341D779E809C761

Uniqueness

Uniqueness Score: -1.00%

Function 007E31C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetPropW.USER32(00000000,DirListData), ref: 007E31CA

Part of subcall function 007E3280: GetPropW.USER32(?,DirListData), ref: 007E328A
Part of subcall function 007E3280: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,007E3420,?,?), ref: 007E3298
Part of subcall function 007E3280: WaitForSingleObject.KERNEL32(?,00000000,?,?,?,?,?,?,?,007E3420,?,?), ref: 007E32A6
Part of subcall function 007E3280: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007E32D2
Part of subcall function 007E3280: TranslateMessage.USER32(?), ref: 007E32DD
Part of subcall function 007E3280: DispatchMessageW.USER32(?), ref: 007E32E4
Part of subcall function 007E3280: WaitForSingleObject.KERNEL32(?,00000000,?,?,?,?,?,?,?,007E3420,?,?), ref: 007E32EE
Part of subcall function 007E3280: ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,007E3420,?,?), ref: 007E3301
Part of subcall function 007E3280: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,007E3420,?,?), ref: 007E330D

CloseHandle.KERNEL32(?), ref: 007E31DF
CloseHandle.KERNEL32(?), ref: 007E31EB
CoTaskMemFree.OLE32(?), ref: 007E31F9
RemovePropW.USER32(00000000,DirListData), ref: 007E3214
GlobalFree.KERNEL32(00000000), ref: 007E321B

Strings

DirListData, xrefs: 007E31C4, 007E320E

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: EventMessageProp$CloseFreeHandleObjectSingleWait$DispatchGlobalPeekRemoveResetTaskTranslate
String ID: DirListData
API String ID: 222544525-869039069
Opcode ID: ae009d0b47e0df149875053f33529c8b8df5b3cc3d09a7c33767a7f9836a6bd5
Instruction ID: 2c176053a5fc6d7e04b0e4af011cfa68c66ad0a0455a1f2eb3eceba4b88647a2
Opcode Fuzzy Hash: ae009d0b47e0df149875053f33529c8b8df5b3cc3d09a7c33767a7f9836a6bd5
Instruction Fuzzy Hash: E3F05E39341601BFE708ABB6EC8CD29BBB8FF493127044169F42AC3220DB78DD50CA10

Uniqueness

Uniqueness Score: -1.00%

Function 007E2D90 Relevance: 12.1, APIs: 8, Instructions: 126stringwindowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(?,?,00000200), ref: 007E2DEB
LoadStringW.USER32(?,?,00000200), ref: 007E2E09
StrChrW.SHLWAPI(?,0000000A,?,?,?,?,?,?,?,?,775DF670), ref: 007E2E78
lstrcpyW.KERNEL32(?,00000002), ref: 007E2E90
lstrcpyW.KERNEL32(?,?), ref: 007E2EB0
lstrcpyW.KERNEL32(?,0085D420), ref: 007E2EBC
GetFocus.USER32 ref: 007E2EBE
MessageBoxExW.USER32(?,?,?,00000040,?), ref: 007E2F01

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: lstrcpy$LoadString$FocusMessage
String ID:
API String ID: 3506571364-0
Opcode ID: 92eb85f73d4a411a60dc2de4456b9ec8fe23345f43b6bae8b1258d03785825bd
Instruction ID: face9c3c2d512467b2cec2583e83a0e342ecba4a561b43d32c9de6ce7e18d8ec
Opcode Fuzzy Hash: 92eb85f73d4a411a60dc2de4456b9ec8fe23345f43b6bae8b1258d03785825bd
Instruction Fuzzy Hash: 6241A2B5600355EBD7209B20DC49BEB77DCFF48310F40882AEA99D7291EA38D549CB96

Uniqueness

Uniqueness Score: -1.00%

Function 007E4140 Relevance: 12.1, APIs: 8, Instructions: 122windowstringCOMMON

Download Yara Rule

APIs

GetShortPathNameW.KERNEL32(?,?,00000104), ref: 007E41A1
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000200), ref: 007E41F5
SendMessageW.USER32 ref: 007E4229
GetShortPathNameW.KERNEL32(?,?,00000104), ref: 007E4254
lstrcmpiW.KERNEL32(?,?), ref: 007E4266
SendMessageW.USER32(?,00001053,00000000,?), ref: 007E427C
SendMessageW.USER32(?,0000102B,00000000,?), ref: 007E42BC
SendMessageW.USER32(?,00001013,00000000,00000000), ref: 007E42C7

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MessageSend$NamePathShort$FileInfolstrcmpi
String ID:
API String ID: 2457365294-0
Opcode ID: 41f4b08ed75a400239832a7d42a116342069487a9c36cdbb17c6826ecefd11d6
Instruction ID: e19b3fd8284933e096d62488dd7a0fd8f5c84a44075c0a885fe25643a230b154
Opcode Fuzzy Hash: 41f4b08ed75a400239832a7d42a116342069487a9c36cdbb17c6826ecefd11d6
Instruction Fuzzy Hash: 0341AF71505344ABE730DB25DC85FABB7ECFB89710F000529FA58D71D0E678DA44CA62

Uniqueness

Uniqueness Score: -1.00%

Function 007DDC80 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000080,00000000,?), ref: 007DE1FA
SetDlgItemTextW.USER32(?,00000064,00000000), ref: 007DE26D
SendDlgItemMessageW.USER32(?,00000064,000000C5,00000103,00000000), ref: 007DE282
GetDlgItem.USER32(?,00000064), ref: 007DE28D
SHAutoComplete.SHLWAPI(00000000), ref: 007DE294
GetDlgItem.USER32(?,00000065), ref: 007DE2C0
SendMessageW.USER32(00000000,00001603,00000000,?), ref: 007DE2D3
ImageList_Destroy.COMCTL32(?), ref: 007DE2E1

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Item$MessageSend$AutoCompleteDestroyImageList_Text
String ID:
API String ID: 2206562733-0
Opcode ID: 9270610e60632d0e8944724cd4cc3866aa25972e56c9e0fdd9220e0b9716361a
Instruction ID: 9c7c03606e9d72017be3590a27290a34818053c7996e5b0c29d6321a99e3707a
Opcode Fuzzy Hash: 9270610e60632d0e8944724cd4cc3866aa25972e56c9e0fdd9220e0b9716361a
Instruction Fuzzy Hash: 52312A31300644ABE621AF28DC4EF7A37A8FB89715F000529F655DB2D1DA79A811C762

Uniqueness

Uniqueness Score: -1.00%

Function 007E5770 Relevance: 12.1, APIs: 8, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000065), ref: 007E5790
LoadImageW.USER32(?,?,00000000,00000000,00000000,00002000), ref: 007E57A5
GetObjectW.GDI32(00000000,00000018,?), ref: 007E57B5
ImageList_Create.COMCTL32(?,?,00000021,00000001,00000000,?,?,?,?,?,?,?,?,?,?,007DE214), ref: 007E57C9
ImageList_AddMasked.COMCTL32(00000000,00000000,FF000000,?,?,?,?,?,?,?,?,?,?,007DE214,00000065), ref: 007E57DA
DeleteObject.GDI32(00000000), ref: 007E57E1
SetRect.USER32(?,00000000,00000000,00000000,00000000), ref: 007E57F4
SendMessageW.USER32(00000000,00001602,00000000,?), ref: 007E580F

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Image$List_Object$CreateDeleteItemLoadMaskedMessageRectSend
String ID:
API String ID: 26161057-0
Opcode ID: 7fce115087cf4305b5b84b732a9e8fc3dc41df93c8597c64fce7735f8ce0f5f3
Instruction ID: 88f44afc6198374b4da2971e6187f7364756543d96c2f7bd01066ea2a02ef3b4
Opcode Fuzzy Hash: 7fce115087cf4305b5b84b732a9e8fc3dc41df93c8597c64fce7735f8ce0f5f3
Instruction Fuzzy Hash: 0B11B276244304BBE7209F609C4AF9BBBECFB49B11F100919F755A61D0D7B0A500CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 007D33B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131stringfileCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?), ref: 007D3548

Part of subcall function 007D26C0: CreateFileW.KERNEL32(008E8DE8,80000000,00000003,00000000,00000003,00000080,00000000), ref: 007D2703
Part of subcall function 007D26C0: LockFileEx.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?), ref: 007D271A

FlushFileBuffers.KERNEL32(00000000,00000000), ref: 007D3411
UnlockFileEx.KERNEL32(00000000,00000000,000000FF,00000000,?), ref: 007D3423
CloseHandle.KERNEL32(00000000), ref: 007D342A
lstrlenW.KERNEL32(?,?), ref: 007D3516

Strings

Settings2, xrefs: 007D348A

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: File$lstrlen$BuffersCloseCreateFlushHandleLockUnlock
String ID: Settings2
API String ID: 2223255397-1942966065
Opcode ID: 81d418b0c840b866a67a48c7ddd4287458ac3275326eb3298608daaae7868d73
Instruction ID: a678e3e92fcde832a5df62590d5aedee7ec4cef0484a45f7c74318bcdc60967b
Opcode Fuzzy Hash: 81d418b0c840b866a67a48c7ddd4287458ac3275326eb3298608daaae7868d73
Instruction Fuzzy Hash: 6A419C315083409BC321AF24D844B6FB7F5BB85710F184A1AF9A593390DB7DAE49CB93

Uniqueness

Uniqueness Score: -1.00%

Function 007E7010 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 115stringCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(0085FD20,634AD31B,75B071C0,00000204), ref: 007E7069
lstrlenW.KERNEL32(?,?,?,?,634AD31B,75B071C0,00000204), ref: 007E70E0
StrDupW.SHLWAPI(?,?,?,?,634AD31B,75B071C0,00000204), ref: 007E713B

Strings

%.2i, xrefs: 007E70A7
", xrefs: 007E70F9
", xrefs: 007E70EC

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: FreeLocallstrlen
String ID: "$"$%.2i
API String ID: 3681330831-3884397407
Opcode ID: b6885b2e93f2b98bf3fa1c43a903f354246ba4e740bbeeecd4541fe438eb3e26
Instruction ID: 14b67c5dd7ad05302a949f29eba2f6835b4d2520d6958d1e4edfd7f1b5f5b946
Opcode Fuzzy Hash: b6885b2e93f2b98bf3fa1c43a903f354246ba4e740bbeeecd4541fe438eb3e26
Instruction Fuzzy Hash: 6041B27190535CDBDB10DF65CC49BAAB3F8FB48310F0141A9E859E7282DB79A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 007E3ED0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001032,00000000,00000000), ref: 007E3EF1
SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 007E3F05
SendMessageW.USER32 ref: 007E3F28
GetParent.USER32(?), ref: 007E3F4B
GetParent.USER32(?), ref: 007E3F6C

Strings

$, xrefs: 007E3F60

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MessageSend$Parent
String ID: $
API String ID: 1020955656-3993045852
Opcode ID: 445a17e841241de09995f4e2268efeae383053a0b41adb6e7bf51e1eb5a399d1
Instruction ID: 0c0decfcc72a8342684da20b4bf84a999816f41971e8df25655cae8134cd1c28
Opcode Fuzzy Hash: 445a17e841241de09995f4e2268efeae383053a0b41adb6e7bf51e1eb5a399d1
Instruction Fuzzy Hash: 31319CB1208305AFE710CF55CC84B57BBE8FB89724F40491EF955D7290D7BAE9098BA1

Uniqueness

Uniqueness Score: -1.00%

Function 007E4910 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 86windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000147,00000000,00000000), ref: 007E4931
SendMessageW.USER32 ref: 007E495B
GetParent.USER32(?), ref: 007E4976
GetParent.USER32(?), ref: 007E4997

Strings

, xrefs: 007E4953
$, xrefs: 007E498B

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MessageParentSend
String ID: $$
API String ID: 928151917-182950533
Opcode ID: 45f56eb049b3704ee4aa9434731e9e2e66e73150cbbe6a60e913eb62719966f1
Instruction ID: d6af4e3b77607a2c3bfdf065d7f01049d44e4977b1b68c24aaff236590c767f8
Opcode Fuzzy Hash: 45f56eb049b3704ee4aa9434731e9e2e66e73150cbbe6a60e913eb62719966f1
Instruction Fuzzy Hash: F1213975204304AFE300CF59DC84B5BBBE8FB88764F50452EF954D7290D775B9098B92

Uniqueness

Uniqueness Score: -1.00%

Function 0083304D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,634AD31B,?,0083315A,?,?,?,00000000), ref: 0083310E

Strings

ext-ms-, xrefs: 008330B8
api-ms-, xrefs: 008330A4

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 09398c2498fd275312fbb9009c485f05e87ff613bedeeaedb8b16956db11a5c3
Instruction ID: 3d9f12e4d97adcd18c2f424fce545d2575f27e19715acd2138646b4e4c98d539
Opcode Fuzzy Hash: 09398c2498fd275312fbb9009c485f05e87ff613bedeeaedb8b16956db11a5c3
Instruction Fuzzy Hash: 6821E435A02A11EBCB369B24DC95A5E7768FF92760F250120E856F7290DB70EF00CAE0

Uniqueness

Uniqueness Score: -1.00%

Function 007ECD9F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000147,00000000,00000000), ref: 007ECDB5
SendMessageW.USER32 ref: 007ECDD9
GetParent.USER32(?), ref: 007ECDFA
GetParent.USER32(?), ref: 007ECE1A

Strings

, xrefs: 007ECDD1
$, xrefs: 007ECE0E

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MessageParentSend
String ID: $$
API String ID: 928151917-182950533
Opcode ID: d85e11b8f7032e63129fdb5e15e6a1fbc1f7b2b2a4419c025bd4539df2e3794b
Instruction ID: e36d4253bcbb7021db05fbb213cee399f0bce7466adcae23c476ff01162465d3
Opcode Fuzzy Hash: d85e11b8f7032e63129fdb5e15e6a1fbc1f7b2b2a4419c025bd4539df2e3794b
Instruction Fuzzy Hash: 852138B1208304AFE310CF65CC85B6BBBF8FB88754F104919F6599B2A1D776E8458F52

Uniqueness

Uniqueness Score: -1.00%

Function 007E931A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57windowstringCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 007E931E
lstrcmpW.KERNEL32(008ED39C,*.*), ref: 007E9330
SendMessageW.USER32(00001024,00000000,00D77800), ref: 007E939A
SendMessageW.USER32(00001004,00000000,00000000), ref: 007E93AB
SendMessageW.USER32(00001015,00000000,-00000001), ref: 007E93BC

Strings

*.*, xrefs: 007E9324

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MessageSend$ProcWindowlstrcmp
String ID: *.*
API String ID: 3670981246-438819550
Opcode ID: 0a0d288abcdf7bc4393b1ca0ca57c61caedef97b31c040d60fea99d4427d30ba
Instruction ID: c07e682666cc4c2989156b72662bfd66e32bb4e93823f3867907f5bdf5de4bc5
Opcode Fuzzy Hash: 0a0d288abcdf7bc4393b1ca0ca57c61caedef97b31c040d60fea99d4427d30ba
Instruction Fuzzy Hash: C711A5322412C1FAE7345762EC8ABBA3B64F74A705F184016F7059E2F1D7E99C40DB51

Uniqueness

Uniqueness Score: -1.00%

Function 007DDEAE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53stringCOMMON

Download Yara Rule

APIs

GetDlgItemTextW.USER32(?,00000064,?,00000104), ref: 007DDEC0
lstrcpyW.KERNEL32(?,?), ref: 007DDED3

Part of subcall function 007E6380: CharNextW.USER32(?,?,775DF670,?,007DF938), ref: 007E63A1
Part of subcall function 007E6380: lstrlenW.KERNEL32(?,?,775DF670,?,007DF938), ref: 007E63B2
Part of subcall function 007E6380: lstrlenW.KERNEL32(?,?,?,007DF938), ref: 007E63C7
Part of subcall function 007E6380: CharPrevW.USER32(?,00000000,?,?,007DF938), ref: 007E63D4
Part of subcall function 007E6380: CharPrevW.USER32(?,00000000,?,?,007DF938), ref: 007E63E7

StrChrW.SHLWAPI(?,00000020), ref: 007DDF1B
GetDlgItem.USER32(?,00000001), ref: 007DDF45
EnableWindow.USER32(00000000), ref: 007DDF4C

Strings

", xrefs: 007DDEE9

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Char$ItemPrevlstrlen$EnableNextTextWindowlstrcpy
String ID: "
API String ID: 2789626447-123907689
Opcode ID: 20550482847f59b1208510a0a52016cc733b8c0b2d038149b111ef62eae2fe3f
Instruction ID: 4291db9ee3d8aed9393f8fc91418160ab936acd7e27df7a83a2ba7d21abbac33
Opcode Fuzzy Hash: 20550482847f59b1208510a0a52016cc733b8c0b2d038149b111ef62eae2fe3f
Instruction Fuzzy Hash: 3B115E39604380AAE730AF61DC49BEFB3A9FFD4780F01052EF556C61D1EBB58854C662

Uniqueness

Uniqueness Score: -1.00%

Function 007EA750 Relevance: 10.6, APIs: 7, Instructions: 51COMMON

Download Yara Rule

APIs

PathIsRelativeW.SHLWAPI(008ED194,00000000), ref: 007EA768
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 007EA77E
PathRemoveFileSpecW.SHLWAPI(?), ref: 007EA789
PathAppendW.SHLWAPI(?,008ED194), ref: 007EA795
PathFileExistsW.SHLWAPI(008ED194), ref: 007EA7A0
PathIsDirectoryW.SHLWAPI(008ED194), ref: 007EA7AB
LoadImageW.USER32(00000000,008ED194,00000000,00000000,00000000,00002010), ref: 007EA7BF

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Path$File$AppendDirectoryExistsImageLoadModuleNameRelativeRemoveSpec
String ID:
API String ID: 1924643234-0
Opcode ID: aa85849823a9531db45a5097bef9809e56e6b8ef1fa91b3dabe91c62dce64519
Instruction ID: 8e7db566aef7fd4cfd549092c5af0e930961b802cab93873394b7048636113a2
Opcode Fuzzy Hash: aa85849823a9531db45a5097bef9809e56e6b8ef1fa91b3dabe91c62dce64519
Instruction Fuzzy Hash: FD0140B5601310AFE7209F60DC4DEAB37ECFF59701F400819B95AC2191EA789944C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 007F244E Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,00000000,007F24C9,007F242C,007F2993,?,?,00000000,?,?), ref: 007F2465
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 007F247B
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 007F2490

Strings

AcquireSRWLockExclusive, xrefs: 007F2475
KERNEL32.DLL, xrefs: 007F2460
ReleaseSRWLockExclusive, xrefs: 007F2485

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 0bad0944cb25a67d35b341a32b758cd9a738d8608e81e90b3f4f1b4f42f976b6
Instruction ID: 23e86f87bead433da9aa18bcca8dd5362f7a2671e66f6652cff0233d78f88ffc
Opcode Fuzzy Hash: 0bad0944cb25a67d35b341a32b758cd9a738d8608e81e90b3f4f1b4f42f976b6
Instruction Fuzzy Hash: 8AF02271299AE69B4F216FBC2CD09363288BA163463044039EF68D6361D6ECCC8796A0

Uniqueness

Uniqueness Score: -1.00%

Function 007E3CE0 Relevance: 9.1, APIs: 6, Instructions: 119windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001032,00000000,00000000), ref: 007E3D18
SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 007E3D28
SendMessageW.USER32(?,?,?,0000104B), ref: 007E3D4D
StrRetToBufW.SHLWAPI(?,?,?,00000104,?,00008000,?,?,?,?,0000104B,00000000,?), ref: 007E3DA9
StrRetToBufW.SHLWAPI(?,?,?,00000104,?,00000001,?,?,?,?,0000104B,00000000,?), ref: 007E3DE8
SHGetDataFromIDListW.SHELL32(?,?,00000001,?,00000250), ref: 007E3E00

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MessageSend$DataFromList
String ID:
API String ID: 101582348-0
Opcode ID: e65befd75c1283c0d297dfb69ef66ff2e31107a7e72331e383cad95dab9daa4f
Instruction ID: e5ca62fd7ba8e280a9d7075260f33e47fdc1a25a0d2237c47810402ce422608d
Opcode Fuzzy Hash: e65befd75c1283c0d297dfb69ef66ff2e31107a7e72331e383cad95dab9daa4f
Instruction Fuzzy Hash: AE417CB0204349AFE320DF69CC85F6AB7E8BF89714F104A1DF6A4C7290E7B4E9448B11

Uniqueness

Uniqueness Score: -1.00%

Function 007E9432 Relevance: 9.1, APIs: 6, Instructions: 67windowtimeCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000423,00000000,00000000), ref: 007E9441
DefWindowProcW.USER32(?,?,?), ref: 007E9472
GetMessageTime.USER32 ref: 007E94A1
GetMessagePos.USER32 ref: 007E94B1
GetMessagePos.USER32 ref: 007E94BA
DefWindowProcW.USER32(?,?,?,?), ref: 007E94E8

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Message$ProcWindow$SendTime
String ID:
API String ID: 247368415-0
Opcode ID: 9bb297d017a271e3f339ff089e45c53758856af9b8510fb1b16ef626b0755dec
Instruction ID: 53b27af3145f03f60f3cc04dcc210443a51473745a59dbc97a02280cafd57d34
Opcode Fuzzy Hash: 9bb297d017a271e3f339ff089e45c53758856af9b8510fb1b16ef626b0755dec
Instruction Fuzzy Hash: 33215876604254AFD320DF68DC45B6FBBE4FB8D710F00881EFA8997290CB75A801DB96

Uniqueness

Uniqueness Score: -1.00%

Function 007F1289 Relevance: 9.1, APIs: 6, Instructions: 63filelibraryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000005,00000000,00000003,00000000,00000000,?,00000000,00000000,?,007F1507,?,00000000,00000000), ref: 007F12AD
CreateFileMappingW.KERNEL32(00000000,00000000,00000008,00000000,00000000,00000000,?,007F1507,?,00000000,00000000,?,?,00000104,?), ref: 007F12C1
CloseHandle.KERNEL32(00000000,?,007F1507,?,00000000,00000000,?,?,00000104,?), ref: 007F12CA
MapViewOfFile.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,007F1507,?,00000000,00000000,?,?,00000104,?), ref: 007F12DA
CloseHandle.KERNEL32(00000000,?,007F1507,?,00000000,00000000,?,?,00000104,?), ref: 007F12E3
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,00000000,00000000,?,007F1507,?,00000000,00000000,?,?,00000104,?), ref: 007F1300

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: File$CloseCreateHandle$LibraryLoadMappingView
String ID:
API String ID: 1262414356-0
Opcode ID: 1f02b793b1f74bd6dd338ec3e7373b2e0841db17e4cd7262a52764374c7e5f48
Instruction ID: c230391934c3bb3cecce11da6855c4de922aa270463bc83c69cb1cd6c75b8e67
Opcode Fuzzy Hash: 1f02b793b1f74bd6dd338ec3e7373b2e0841db17e4cd7262a52764374c7e5f48
Instruction Fuzzy Hash: 3D015E7664171CFFF3201B696C8CF7B779CFB41BAAF154528BA1592290D6B89C40C670

Uniqueness

Uniqueness Score: -1.00%

Function 007E26E0 Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 007E26E9
ShowWindow.USER32(00000000,?,00000000), ref: 007E26F3

Part of subcall function 007E7C40: DialogBoxIndirectParamW.USER32(00000000,00000000,?,?,?), ref: 007E7C5A
Part of subcall function 007E7C40: LocalFree.KERNEL32(00000000), ref: 007E7C67

ShowWindow.USER32(00000001), ref: 007E2715
ShowWindow.USER32(?,00000001), ref: 007E271A
CheckRadioButton.USER32(?,00000068,0000006A,00000069), ref: 007E2729
CheckRadioButton.USER32(?,00000064,00000065,00000065), ref: 007E2732

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ShowWindow$ButtonCheckRadio$DialogFreeIndirectLocalParam
String ID:
API String ID: 468163734-0
Opcode ID: 1d39bdf8e24d41ec76878fced7cf494a98e68a5191646477102ad886efd7cb94
Instruction ID: abefadd3e76b114ed5970eeb031ac495509dd9e699f126f91e7ffbba0348083f
Opcode Fuzzy Hash: 1d39bdf8e24d41ec76878fced7cf494a98e68a5191646477102ad886efd7cb94
Instruction Fuzzy Hash: B7F0FC31FC03547AD6206712AC47F2FBF66FB45F10F100027B6057A1E199E72410CD91

Uniqueness

Uniqueness Score: -1.00%

Function 007DFE00 Relevance: 9.0, APIs: 6, Instructions: 42stringwindowCOMMON

Download Yara Rule

APIs

AppendMenuW.USER32(00000000,?,?,00000000), ref: 007DFE18
lstrcmpiW.KERNEL32(?,008E9F48,?,?), ref: 007DFE28
IsDlgButtonChecked.USER32(00000066), ref: 007DFE3A
CharNextW.USER32(?,008E9F48,?,?), ref: 007DFE4B
lstrcmpiW.KERNEL32(00000000,?,?), ref: 007DFE52
IsDlgButtonChecked.USER32(00000066), ref: 007DFE64

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ButtonCheckedlstrcmpi$AppendCharMenuNext
String ID:
API String ID: 2957333968-0
Opcode ID: fc10150420b1d48b96cfc40c2c872eec3fab5dd79a8d3068a3079910daa4dd1c
Instruction ID: 724519e5e35b9a96098e7b1c74d468a462d5d3b2c0b35b2b016dabeb34252949
Opcode Fuzzy Hash: fc10150420b1d48b96cfc40c2c872eec3fab5dd79a8d3068a3079910daa4dd1c
Instruction Fuzzy Hash: 9801F435900290EFCB246F24ED89A6A3B7AFB16B09F00442AF451E5370E7BA9C20CB45

Uniqueness

Uniqueness Score: -1.00%

Function 007E7EA0 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000048,00000008,00000000), ref: 007E7EC4
GetWindowRect.USER32(?,?), ref: 007E7EE0
DrawAnimatedRects.USER32(?,00000003,?,?), ref: 007E7EF3
ShowWindow.USER32(?,00000005), ref: 007E7EFC
SetActiveWindow.USER32(?), ref: 007E7F03
SetForegroundWindow.USER32(?), ref: 007E7F0A

Part of subcall function 007E7C80: FindWindowExW.USER32(00000000,00000000,Shell_TrayWnd,00000000), ref: 007E7CA3
Part of subcall function 007E7C80: FindWindowExW.USER32(00000000,00000000,TrayNotifyWnd,00000000), ref: 007E7CB3
Part of subcall function 007E7C80: GetWindowRect.USER32(00000000,?), ref: 007E7CBB

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Window$FindRect$ActiveAnimatedDrawForegroundInfoParametersRectsShowSystem
String ID:
API String ID: 2112798254-0
Opcode ID: 982fb76ed7e1dc57c4818f5bccc825c75821cf128d204f424c1e24c668d52c76
Instruction ID: fc2339310fc7a9bac087748aa65135198b5658caf0b9a86fdd9d3702f0f62529
Opcode Fuzzy Hash: 982fb76ed7e1dc57c4818f5bccc825c75821cf128d204f424c1e24c668d52c76
Instruction Fuzzy Hash: CC01AD75105A10AFD304EF20DC49F9F7BACFF4A701F404409F589910A0EB389A49CBA7

Uniqueness

Uniqueness Score: -1.00%

Function 007E5880 Relevance: 9.0, APIs: 6, Instructions: 35COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(0000A02A,000000EC), ref: 007E588B
SetWindowLongW.USER32(0000A02A,000000EC,00000000), ref: 007E589A
MulDiv.KERNEL32(?,000000FF,00000064), ref: 007E58AB
SetLayeredWindowAttributes.USER32(0000A02A,00000000,?,00000002), ref: 007E58BE
GetWindowLongW.USER32(0000A02A,000000EC), ref: 007E58C7
SetWindowLongW.USER32(0000A02A,000000EC,00000000), ref: 007E58D6

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 0fcc1b5d12b0fcf39dd877678800bea089b5f3b4103ccf1b1f773a88da41ca78
Instruction ID: 55cbd5a59c71cec84e7d45ae637d51b390d73421d539656c9f52beca0e936d63
Opcode Fuzzy Hash: 0fcc1b5d12b0fcf39dd877678800bea089b5f3b4103ccf1b1f773a88da41ca78
Instruction Fuzzy Hash: A9F08236149621BFDB152764AC0EFAB7E28FF87722F204259F152D00E1DB650410CB66

Uniqueness

Uniqueness Score: -1.00%

Function 02A543F0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 199fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,02B11784,7E6776EF,00000000,?), ref: 02A54588
WriteFile.KERNEL32(00000000,ATTENTION!Your network has been breached and all data was encrypted. Please contact us at:https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 26d371a9-efda-4e82-9989-01e292244d65*!* To access .onion websites downlo,00000443,00000000), ref: 02A545AD
CloseHandle.KERNEL32(00000000), ref: 02A545B4

Strings

ATTENTION!Your network has been breached and all data was encrypted. Please contact us at:https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 26d371a9-efda-4e82-9989-01e292244d65*!* To access .onion websites downlo, xrefs: 02A545A7
vg~, xrefs: 02A544A0

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID: ATTENTION!Your network has been breached and all data was encrypted. Please contact us at:https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/ Login ID: 26d371a9-efda-4e82-9989-01e292244d65*!* To access .onion websites downlo$vg~
API String ID: 1065093856-2983004374
Opcode ID: 803bcaff27075cf79196448e386710cd7ead2dce63e68610d04df34ce0384c89
Instruction ID: db53ff37fb79aaa98429a12a33785edf01b46042cfb06b1830f3e2033cb7c81c
Opcode Fuzzy Hash: 803bcaff27075cf79196448e386710cd7ead2dce63e68610d04df34ce0384c89
Instruction Fuzzy Hash: 7371D471D00218DFDB14CF68D998BEEB7B5FF48314F104619E916E7690DB34AA86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0082C389 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,008E7EAA,00000104), ref: 0082C3E6

Strings

..., xrefs: 0082C434
Microsoft Visual C++ Runtime Library, xrefs: 0082C47B
<program name unknown>, xrefs: 0082C3F5
Runtime Error!Program: , xrefs: 0082C3B2

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: FileModuleName
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 514040917-4022980321
Opcode ID: 226d593d4c1c5fef298d3c5188f6de907c22ac118485c23b271f0d456ddd51ef
Instruction ID: 06d114cda0e21c496aeb0db48006a2c11a2ff98ac57fe3fcb580aa49c0ca093f
Opcode Fuzzy Hash: 226d593d4c1c5fef298d3c5188f6de907c22ac118485c23b271f0d456ddd51ef
Instruction Fuzzy Hash: 72213422A4032236E7207A66BC5AE7F369CFB92B44F044470FC4CE2281F655CE85C1D6

Uniqueness

Uniqueness Score: -1.00%

Function 02ABC62C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,02ABC6EF,?,?,02B1894C,00000000,?,02ABC81A,00000004,InitializeCriticalSectionEx,02AF29B0,02AF29B8,00000000), ref: 02ABC6BD

Strings

api-ms-, xrefs: 02ABC67D

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: f9c0e9015faab8fdfb4475913f0a36d0559b26713dcf522b2030c8ee53ff2cc6
Instruction ID: c45243c6efa7a192a704a4b66a92c98cee8311464cd081f79431eb57e90ad3ed
Opcode Fuzzy Hash: f9c0e9015faab8fdfb4475913f0a36d0559b26713dcf522b2030c8ee53ff2cc6
Instruction Fuzzy Hash: 2F11C432E41221AFDB234B789C94F9A33A9AF01B74F112522F901EB181DF60E901CAE1

Uniqueness

Uniqueness Score: -1.00%

Function 007E61B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59stringCOMMON

Download Yara Rule

APIs

PathFindExtensionW.SHLWAPI(?,.lnk,00000000,-00000001), ref: 007E61E2
lstrcmpiW.KERNEL32(00000000), ref: 007E61E9

Part of subcall function 007E6080: CoCreateInstance.OLE32(0085378C,00000000,00000001,0084FD7C,?,0000C356,?), ref: 007E60AF
Part of subcall function 007E6080: lstrcpyW.KERNEL32(?,?), ref: 007E60DB
Part of subcall function 007E6080: ExpandEnvironmentStringsW.KERNEL32(?,?,00000138), ref: 007E6152
Part of subcall function 007E6080: lstrcpynW.KERNEL32(?,?,?), ref: 007E616C

PathIsDirectoryW.SHLWAPI(?), ref: 007E6229
lstrcpynW.KERNEL32(?,?,?), ref: 007E6240

Strings

.lnk, xrefs: 007E61DC

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Pathlstrcpyn$CreateDirectoryEnvironmentExpandExtensionFindInstanceStringslstrcmpilstrcpy
String ID: .lnk
API String ID: 403286655-24824748
Opcode ID: 2391534818ccab04331a6d2daa24fa2b6fbc2b5315107e9fbfd648ec73caff3c
Instruction ID: ea4cfb00722290adcf9c6590292f9930e3a3a5341bbb2cee58b79550b9fbc59d
Opcode Fuzzy Hash: 2391534818ccab04331a6d2daa24fa2b6fbc2b5315107e9fbfd648ec73caff3c
Instruction Fuzzy Hash: 1711E3B56052109BD7209B25DC0ABAE739CBFA8740F448839EA09C6280EABCC945C792

Uniqueness

Uniqueness Score: -1.00%

Function 007F0F26 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383},00000000,00000001,?), ref: 007F0F5E
RegQueryValueExW.ADVAPI32(?,Locale,00000000,00000000,?,00000006), ref: 007F0F7B
RegCloseKey.ADVAPI32(?), ref: 007F0F86

Strings

Locale, xrefs: 007F0F73
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}, xrefs: 007F0F54

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Locale$Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}
API String ID: 3677997916-1161606707
Opcode ID: cdf7b567e9281c886087f48a436a39b0d40e2255860ea8a4933d3c7631a9dab7
Instruction ID: 3756e3215fe38cde4060caf854f3539ae7fd1670504315f68ad35b2d091ae766
Opcode Fuzzy Hash: cdf7b567e9281c886087f48a436a39b0d40e2255860ea8a4933d3c7631a9dab7
Instruction Fuzzy Hash: B211A079900219AACB209FA5EC49EBF77B8FB95700F010825FA12E2362E7749A45C761

Uniqueness

Uniqueness Score: -1.00%

Function 007ED165 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53stringwindowCOMMON

Download Yara Rule

APIs

lstrcmpW.KERNEL32(008ED39C,*.*), ref: 007ED16F
lstrcpyW.KERNEL32(008ED39C,*.*), ref: 007ED18F
SendMessageW.USER32(?,00000111,00019D0D,00000000), ref: 007ED1E1
SendMessageW.USER32(00001013,00000000,00000000,00000000), ref: 007ED215

Strings

*.*, xrefs: 007ED165, 007ED185

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MessageSend$lstrcmplstrcpy
String ID: *.*
API String ID: 183746767-438819550
Opcode ID: f6dd8562741e19cf4ad15319375a571cd5dd9976b29b7a0fdd0273569a9cfff6
Instruction ID: 784cc5d348140acf9e7b98aed23a475f62731a46f5d9bddf762740b4115c6647
Opcode Fuzzy Hash: f6dd8562741e19cf4ad15319375a571cd5dd9976b29b7a0fdd0273569a9cfff6
Instruction Fuzzy Hash: 341140752403C1EBE730AB21EC46BAB7794FB44314F044425F608962E1E6B99848CB53

Uniqueness

Uniqueness Score: -1.00%

Function 007E4770 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000147,00000000,00000000), ref: 007E478A
SendMessageW.USER32 ref: 007E47B9
StrRetToBufW.SHLWAPI(?,?,?,00000040), ref: 007E47E8
PathRemoveBackslashW.SHLWAPI ref: 007E47EF

Strings

, xrefs: 007E47B1

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MessageSend$BackslashPathRemove
String ID:
API String ID: 1132864304-3916222277
Opcode ID: f5ea679ae68c60f4bd52ed1d9f6b114e0396877ae2cebb8e9e8f70fa8a52627d
Instruction ID: 217a2f3ff62f782c12fe1a56a92fd37fc8349486535a1e4c1ae2d5f2aad868b8
Opcode Fuzzy Hash: f5ea679ae68c60f4bd52ed1d9f6b114e0396877ae2cebb8e9e8f70fa8a52627d
Instruction Fuzzy Hash: 8E014075200600AFE3109B69EC45FAB77B8BBCA724F408519F258D72E0D375E505CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 007D1300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 007D131A
#410.COMCTL32(?,007D1550,00000000,00000000), ref: 007D1340
SendMessageW.USER32(?,00001036,00000000,00010030), ref: 007D1353
SendMessageW.USER32(?,00000127,00010001,00000000), ref: 007D1362

Strings

ItemsView, xrefs: 007D136C, 007D1376

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MessageSend$#410
String ID: ItemsView
API String ID: 147371132-272564461
Opcode ID: 65074c474e3103045c831a80e4789f56185325a36eac2d275a060a99f1ada950
Instruction ID: e254dc5aa315e0e5b04ddf8933c8d0600256f06fa75269fcfd583b99f520e081
Opcode Fuzzy Hash: 65074c474e3103045c831a80e4789f56185325a36eac2d275a060a99f1ada950
Instruction Fuzzy Hash: E1F0BBB279036079F63157505C87FBA2A2CF759F91F150056F7007E2D1C6D8388197B9

Uniqueness

Uniqueness Score: -1.00%

Function 0082A564 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,634AD31B,?,?,00000000,0084D8A8,000000FF,?,0082A4EB,0082A63A,?,0082A4BF,00000000), ref: 0082A599
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0082A5AB
FreeLibrary.KERNEL32(00000000,?,?,00000000,0084D8A8,000000FF,?,0082A4EB,0082A63A,?,0082A4BF,00000000), ref: 0082A5CD

Strings

mscoree.dll, xrefs: 0082A592
CorExitProcess, xrefs: 0082A5A3

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 62f52cc367bcb44dfb9e8bf0309cc1ee0c3fdf539915a9e83a946fae1e3f0a28
Instruction ID: 81f7b0d99ed806a556bb28fddb49c0010fc3d825a88666f166c04acd8ee4236f
Opcode Fuzzy Hash: 62f52cc367bcb44dfb9e8bf0309cc1ee0c3fdf539915a9e83a946fae1e3f0a28
Instruction Fuzzy Hash: AF01A235904629BFDB158F90DC09FAFBBB9FB05B11F044525FC21E22D0DBB89A40CA90

Uniqueness

Uniqueness Score: -1.00%

Function 00833211 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,008331CA), ref: 00833220
GetLastError.KERNEL32(?,008331CA), ref: 0083322A
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00833268

Strings

ext-ms-, xrefs: 0083324D
api-ms-, xrefs: 00833237

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-$ext-ms-
API String ID: 3177248105-537541572
Opcode ID: bca6baa922c7e5d30a0b40871425a167d8211f3999331eebb210fb444827c6ff
Instruction ID: 06dba862154ece127f5c6c4e82e1702090499e216dd34e52fe76c4fc0b759aac
Opcode Fuzzy Hash: bca6baa922c7e5d30a0b40871425a167d8211f3999331eebb210fb444827c6ff
Instruction Fuzzy Hash: 31F01230680205B7DF212A61EC0AB593A56FF51B41F144020FD4CE81E1E7B5E955C585

Uniqueness

Uniqueness Score: -1.00%

Function 007E51D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(uxtheme.dll), ref: 007E51D9
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 007E51EB
FreeLibrary.KERNEL32(00000000), ref: 007E51FA

Strings

uxtheme.dll, xrefs: 007E51D2
IsAppThemed, xrefs: 007E51E5

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: IsAppThemed$uxtheme.dll
API String ID: 145871493-2993874081
Opcode ID: 4982fd2979e36356cffad9ee41ea9463e971c03ab1b8bf1f7e9079339ffcf2d5
Instruction ID: 22278fc5f985fd81a561701bd0121c3dec97df2aa9c941e5a8fb0969ae8bc98a
Opcode Fuzzy Hash: 4982fd2979e36356cffad9ee41ea9463e971c03ab1b8bf1f7e9079339ffcf2d5
Instruction Fuzzy Hash: F5D05B3534175457522117796C4CD6BB66DFEC6F573090114F815D2214DF788D41C661

Uniqueness

Uniqueness Score: -1.00%

Function 00845E74 Relevance: 7.8, APIs: 5, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a64c63e7cec01738617d3eabcc922df7e2743c22960d2992ced37b05be051309
Instruction ID: 2cfc901ed75d89dc390f0c9d9a21766d65a78b0605a8870c118ce659bbdfb61c
Opcode Fuzzy Hash: a64c63e7cec01738617d3eabcc922df7e2743c22960d2992ced37b05be051309
Instruction Fuzzy Hash: 5CB1E374A0064DEFDB16CF98C880BADBBB1FF46308F144169E515EB293EB709951CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02A541D0 Relevance: 7.6, APIs: 5, Instructions: 146COMMON

Download Yara Rule

APIs

FindFirstVolumeW.KERNEL32(?,00000200,7E6776EF), ref: 02A54241
GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,00000400,?), ref: 02A5426A
GetVolumeInformationW.KERNEL32(?,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 02A54292
FindNextVolumeW.KERNEL32(00000000,?,00000200), ref: 02A543B2
FindVolumeClose.KERNEL32(00000000), ref: 02A543C1

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: Volume$Find$CloseFirstInformationNameNamesNextPath
String ID:
API String ID: 1001540003-0
Opcode ID: bbb57c3a47e73bf377fa6d016899fb875b20af06fb4f894e9121323d41850983
Instruction ID: acd5251f5389acb3afbdd0fa6d479b04f3031e02f35bf923d74d819619af4730
Opcode Fuzzy Hash: bbb57c3a47e73bf377fa6d016899fb875b20af06fb4f894e9121323d41850983
Instruction Fuzzy Hash: F95181719002189BEB24CF24CD84FEAB3B8FF48714F144A99E91997690DF74AAC5CF50

Uniqueness

Uniqueness Score: -1.00%

Function 007D3190 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 65COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,true,true,?,00000040), ref: 007D31F6

Strings

Settings, xrefs: 007D320D
true, xrefs: 007D31BD, 007D31E6, 007D31EF
ShowDriveBox, xrefs: 007D320C
false, xrefs: 007D31B8

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Settings$ShowDriveBox$false$true
API String ID: 626452242-921498056
Opcode ID: 9eababad6c5e91474baa62212dd8eb08de4c55a2a53438f0372128bc721506c5
Instruction ID: 51d77f64346b908d46a83d62a65097adf93b0c334b5593ac1c94253f31acab23
Opcode Fuzzy Hash: 9eababad6c5e91474baa62212dd8eb08de4c55a2a53438f0372128bc721506c5
Instruction Fuzzy Hash: 3211E7757002005BE7349B28DC16B7677E9FBDA701F44842AFA99C7280ED78990CC393

Uniqueness

Uniqueness Score: -1.00%

Function 007E6380 Relevance: 7.6, APIs: 5, Instructions: 53stringCOMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,775DF670,?,007DF938), ref: 007E63A1
lstrlenW.KERNEL32(?,?,775DF670,?,007DF938), ref: 007E63B2
lstrlenW.KERNEL32(?,?,?,007DF938), ref: 007E63C7
CharPrevW.USER32(?,00000000,?,?,007DF938), ref: 007E63D4
CharPrevW.USER32(?,00000000,?,?,007DF938), ref: 007E63E7

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Char$Prevlstrlen$Next
String ID:
API String ID: 2482157412-0
Opcode ID: 863f33b0446d01ab197591b83d569cc5ff3599b8c8590fb653d84c9d6f72b030
Instruction ID: 74afa48dc372e4ee32786118cb16fc500dd3b711c8d05db5e2f0e1d6aed88b46
Opcode Fuzzy Hash: 863f33b0446d01ab197591b83d569cc5ff3599b8c8590fb653d84c9d6f72b030
Instruction Fuzzy Hash: 300126668103645FCB206B6ADCC497B77BCFB9E3A0B050466E401C7162EBB88C51C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 007E5060 Relevance: 7.6, APIs: 5, Instructions: 53memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?,00000000,775A3070,75B03760,?,007EF281,?,00000100,00002712,?), ref: 007E506E
LoadStringW.USER32(?,00000000,?), ref: 007E5087
LoadStringW.USER32(?,00000000,?), ref: 007E509E
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 007E50C2
lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 007E50C9

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: LoadLocalString$AllocFreelstrlen
String ID:
API String ID: 389633860-0
Opcode ID: 32812637fb416a8a09f7956a0b53464c859603af043c7b702e613b9eddfebe6f
Instruction ID: 6b6dd62324feb9459ce0b597229f55478497662b271b23f01aea12111a526a31
Opcode Fuzzy Hash: 32812637fb416a8a09f7956a0b53464c859603af043c7b702e613b9eddfebe6f
Instruction Fuzzy Hash: CD01A775202655AFC7209B66EC48C6B7B6CFFC63667000426F505C2120E775D804CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 007E5160 Relevance: 7.5, APIs: 5, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(?,?), ref: 007E5175
OpenProcess.KERNEL32(00000410,00000000,?,?,?), ref: 007E5186
EnumProcessModules.PSAPI(00000000,?,00000004,00000000,?,?), ref: 007E519B
GetModuleFileNameExW.PSAPI(00000000,?,?,00000100,?,?), ref: 007E51AC
CloseHandle.KERNEL32(00000000,?,00000100,?,?), ref: 007E51B3

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Process$CloseEnumFileHandleModuleModulesNameOpenThreadWindow
String ID:
API String ID: 1339411102-0
Opcode ID: b23082e82020942c565886a27b69403222c3752fedf6a4b46f2d0a89f8faf0fb
Instruction ID: 4ed543a53bd41f147e699a551cabcb4b6a57f4698fdea977efab7f651b579a3b
Opcode Fuzzy Hash: b23082e82020942c565886a27b69403222c3752fedf6a4b46f2d0a89f8faf0fb
Instruction Fuzzy Hash: F0F0827A004210BFE3119B58EC08FDB7FACFF8A751F004829F649C1160D7B89549CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 007E6820 Relevance: 7.5, APIs: 5, Instructions: 31stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 007E6825
GlobalAlloc.KERNEL32(00002042,00000000), ref: 007E6838
GlobalLock.KERNEL32(00000000), ref: 007E6845
lstrcpyW.KERNEL32(-00000014), ref: 007E6876
GlobalUnlock.KERNEL32(00000000), ref: 007E687D

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Global$AllocLockUnlocklstrcpylstrlen
String ID:
API String ID: 270455586-0
Opcode ID: 73d924398eed1770db94d4f8a7693b856d4fa7b35d8bc15ae9afeafcb4169537
Instruction ID: 3b2b24a9764a8cf73a8d9cce0c92b44ba763bc964d33738afa9265cf5c51f6cb
Opcode Fuzzy Hash: 73d924398eed1770db94d4f8a7693b856d4fa7b35d8bc15ae9afeafcb4169537
Instruction Fuzzy Hash: 32F05E755012109FE3115F65EC0CB9A7AA8FB86756F068055E400CB271DBB9C845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 007F2D08 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(008E76F4), ref: 007F2D12
LeaveCriticalSection.KERNEL32(008E76F4), ref: 007F2D1F
RtlWakeAllConditionVariable.NTDLL ref: 007F2DEC
SetEvent.KERNEL32 ref: 007F2DF6
ResetEvent.KERNEL32 ref: 007F2E02

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
String ID:
API String ID: 3916383385-0
Opcode ID: 943e8b3e0e6751cd1b995b0346b3d1a13689ca506565632815bbf41787f6817e
Instruction ID: 614de591832071d959c56936939acdf1a1ea07ae465c1c697a4177e5a8874387
Opcode Fuzzy Hash: 943e8b3e0e6751cd1b995b0346b3d1a13689ca506565632815bbf41787f6817e
Instruction Fuzzy Hash: B2F06D36619864EBCB012F58FC08AE97BA8FB17727B020052F611D7230CB745C41CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 007D3D20 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 174fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007D26C0: CreateFileW.KERNEL32(008E8DE8,80000000,00000003,00000000,00000003,00000080,00000000), ref: 007D2703
Part of subcall function 007D26C0: LockFileEx.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?), ref: 007D271A

FlushFileBuffers.KERNEL32(00000000,00000000), ref: 007D3D8C
UnlockFileEx.KERNEL32(00000000,00000000,000000FF,00000000,?), ref: 007D3D9E
CloseHandle.KERNEL32(00000000), ref: 007D3DA5

Strings

Filters, xrefs: 007D3DDD, 007D3E1F, 007D3E53

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: File$BuffersCloseCreateFlushHandleLockUnlock
String ID: Filters
API String ID: 3886186091-3083492881
Opcode ID: 0fc02ca1727f5c00a454fc084669571acb002cd45b2a25483fa34401c01819cf
Instruction ID: 201ca27bc34261ed5365f76d32f82146f4896ca37dc1f5e8143cf72c19407459
Opcode Fuzzy Hash: 0fc02ca1727f5c00a454fc084669571acb002cd45b2a25483fa34401c01819cf
Instruction Fuzzy Hash: C5519E71A083049BC720EF14C884B6FB7F4FB85311F14492EF955973A1D7799A49CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 007D26C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 79fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(008E8DE8,80000000,00000003,00000000,00000003,00000080,00000000), ref: 007D2703
LockFileEx.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?), ref: 007D271A

Strings

AcquireReadFileLock(%s): NO READER LOCK ACQUIRED!, xrefs: 007D273A
AcquireReadFileLock(%s): INVALID FILE HANDLE!, xrefs: 007D2753

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: File$CreateLock
String ID: AcquireReadFileLock(%s): INVALID FILE HANDLE!$AcquireReadFileLock(%s): NO READER LOCK ACQUIRED!
API String ID: 3593386577-1051419391
Opcode ID: 2617d1fd2fb31d415874a3d4f029c8e9329657402cfa0cd499a9ae0b4276b06b
Instruction ID: 5469d5aaab1b48938db664ccd59c6b0201ecb3dd9e43767923a45cd8ef7ac450
Opcode Fuzzy Hash: 2617d1fd2fb31d415874a3d4f029c8e9329657402cfa0cd499a9ae0b4276b06b
Instruction Fuzzy Hash: C5215031741314B3D130AB34DC57F6B37DCBB91B31F500716BB64962C1EA9CA60A8251

Uniqueness

Uniqueness Score: -1.00%

Function 007E42D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72stringCOMMON

Download Yara Rule

APIs

lstrcmpW.KERNEL32(?,*.*), ref: 007E4339
StrChrW.SHLWAPI(?,0000003B,?,*.*), ref: 007E435B
StrChrW.SHLWAPI(?,0000003B,?,*.*), ref: 007E437D

Strings

*.*, xrefs: 007E4333

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: lstrcmp
String ID: *.*
API String ID: 1534048567-438819550
Opcode ID: 3dcc60209f35be21a46391a975c8044314a12e617c208fe8d724ff1860a6ad38
Instruction ID: 2964f426f1d60052d5213ad55f792ce6bf74f041ea16777c81c94faccfb1ea47
Opcode Fuzzy Hash: 3dcc60209f35be21a46391a975c8044314a12e617c208fe8d724ff1860a6ad38
Instruction Fuzzy Hash: 4321E4B62027019BD7219F25DC84BB7B3E9FF89750F04856EEA46D7680EB36A901CB10

Uniqueness

Uniqueness Score: -1.00%

Function 007D36D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72fileCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(00000000,00000000), ref: 007D372B
UnlockFileEx.KERNEL32(00000000,00000000,000000FF,00000000,?), ref: 007D373D
CloseHandle.KERNEL32(00000000), ref: 007D3744

Strings

Settings2, xrefs: 007D3784

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: File$BuffersCloseFlushHandleUnlock
String ID: Settings2
API String ID: 838080827-1942966065
Opcode ID: 941dab3f67503739cb8951c1f78812af6df44d5a9eefc7bc33372e5cbc5fee9f
Instruction ID: 40dc2aa7fda383c092ccfe7009cb24693b898d878fa9263f57cc9c7f7b296da2
Opcode Fuzzy Hash: 941dab3f67503739cb8951c1f78812af6df44d5a9eefc7bc33372e5cbc5fee9f
Instruction Fuzzy Hash: 57110B726043109BC610AB2CDD85A9EB7B4FFD5330F54062AF954A3390E6789A0DC7A3

Uniqueness

Uniqueness Score: -1.00%

Function 00821408 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,0082115D,00000000,00000004,00000000), ref: 00821457
GetLastError.KERNEL32(?,?,?,007E326C,007E3860), ref: 00821463

Strings

l2~`8~, xrefs: 0082142C

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: CreateErrorLastThread
String ID: l2~`8~
API String ID: 1689873465-1979742507
Opcode ID: be6b1f07c36ada2c5bf95753816045dfa316b35933a3899a28d47cdb9fa6fdaa
Instruction ID: 71d0fdb4d4de9cfaeb0adf8b82889043d56568ce4128452854e9d96879b679a4
Opcode Fuzzy Hash: be6b1f07c36ada2c5bf95753816045dfa316b35933a3899a28d47cdb9fa6fdaa
Instruction Fuzzy Hash: D901C432900224BBDF11ABA9EC0DBAE7A69FF91775F304215F528D21D0DB708981D761

Uniqueness

Uniqueness Score: -1.00%

Function 007F0130 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53stringwindowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000064,00000001,00000010,00000010,?,?), ref: 007F0164
lstrcpyW.KERNEL32 ref: 007F01B8
Shell_NotifyIconW.SHELL32(00000002,000003BC), ref: 007F01D0

Strings

MiniPath, xrefs: 007F01A6

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: IconImageLoadNotifyShell_lstrcpy
String ID: MiniPath
API String ID: 2060738540-3848962392
Opcode ID: 6b1fac613669cf18fe234110dca212899bf2b6679b2cd47bd9f0409b71332e0b
Instruction ID: 7fd31288dfeadee086613f1c590fc55c46f75cee8defe21a5d1132b0bb8deeeb
Opcode Fuzzy Hash: 6b1fac613669cf18fe234110dca212899bf2b6679b2cd47bd9f0409b71332e0b
Instruction Fuzzy Hash: 97117375604314AFE3218F44DC45B5BBBE8FB88B54F40441DF658A7391D3B89A08CF96

Uniqueness

Uniqueness Score: -1.00%

Function 007D2640 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000004,00000080,00000000), ref: 007D2664
LockFileEx.KERNEL32(00000000,00000002,00000000,000000FF,00000000,?,?,C0000000,00000003,00000000,00000004,00000080,00000000), ref: 007D267B

Part of subcall function 007E2F30: GetLastError.KERNEL32(?,00000000,?,?,007D2773), ref: 007E2F39
Part of subcall function 007E2F30: FormatMessageW.KERNEL32 ref: 007E2F63
Part of subcall function 007E2F30: lstrlenW.KERNEL32(00000000,00000000,008E8DE8), ref: 007E2F7A
Part of subcall function 007E2F30: lstrlenW.KERNEL32(00000000), ref: 007E2F82
Part of subcall function 007E2F30: LocalAlloc.KERNEL32(00000040,00000000), ref: 007E2F92
Part of subcall function 007E2F30: GetFocus.USER32 ref: 007E2FBF
Part of subcall function 007E2F30: MessageBoxExW.USER32(?,00000000,MiniPath - ERROR,00000010,?), ref: 007E2FDA
Part of subcall function 007E2F30: LocalFree.KERNEL32(00000000,?,?,007D2773), ref: 007E2FE1
Part of subcall function 007E2F30: LocalFree.KERNEL32(?), ref: 007E2FE7

Strings

AcquireWriteFileLock(): INVALID FILE HANDLE!, xrefs: 007D26A0
AcquireWriteFileLock(): NO EXCLUSIVE LOCK ACQUIRED!, xrefs: 007D268A

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Local$FileFreeMessagelstrlen$AllocCreateErrorFocusFormatLastLock
String ID: AcquireWriteFileLock(): INVALID FILE HANDLE!$AcquireWriteFileLock(): NO EXCLUSIVE LOCK ACQUIRED!
API String ID: 434643049-250906885
Opcode ID: b8e61bd49d525a7299103e27d160ab7e411d4a8f9d68b1b889318e65bed737e1
Instruction ID: 5bffd545c9a242626efc27380ae4db58e610c23597d951907b97656e4385f457
Opcode Fuzzy Hash: b8e61bd49d525a7299103e27d160ab7e411d4a8f9d68b1b889318e65bed737e1
Instruction Fuzzy Hash: F1F0223139631132E230123D7C09F4522A8AF83BB2F284326BB70EA1E5CA949C4B4168

Uniqueness

Uniqueness Score: -1.00%

Function 007D1AC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

RtlGetNtVersionNumbers.NTDLL(008E89AC,008E89A8,008E89B0), ref: 007D1B1F
SetPropW.USER32(?,UseImmersiveDarkModeColors,75B06730), ref: 007D1B45
SetWindowCompositionAttribute.USER32 ref: 007D1B6E

Part of subcall function 007D1990: SystemParametersInfoW.USER32(00000042,0000000C,00000000), ref: 007D19AF

Strings

UseImmersiveDarkModeColors, xrefs: 007D1B3F

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: AttributeCompositionInfoNumbersParametersPropSystemVersionWindow
String ID: UseImmersiveDarkModeColors
API String ID: 153591563-1514937872
Opcode ID: ae97ad74af26c1b1ce9839b962729f3fade2d8ccd9a312071518971c51e02351
Instruction ID: eab34dab73d7a59a2f356f14908f0af88e1b7657bac96089e74949b003774c95
Opcode Fuzzy Hash: ae97ad74af26c1b1ce9839b962729f3fade2d8ccd9a312071518971c51e02351
Instruction Fuzzy Hash: EB118EB4505380EFD710AF18D885BAA7BE4FF46749F44884AF899D73A2E7788804CB57

Uniqueness

Uniqueness Score: -1.00%

Function 007EFE70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38stringCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000040), ref: 007EFEA2
lstrcmpiW.KERNEL32(?,MiniPath), ref: 007EFEB6
IsWindowEnabled.USER32(?), ref: 007EFEC3

Strings

MiniPath, xrefs: 007EFEAC

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ClassEnabledNameWindowlstrcmpi
String ID: MiniPath
API String ID: 2986337850-3848962392
Opcode ID: 6d763035fada3ff549180f66dbb645f993e3937cfdbba58ff2d3854ebaf51331
Instruction ID: ec2b9c062a28c26cb22910963932ee649c1955979ffc385141a75d02c5605700
Opcode Fuzzy Hash: 6d763035fada3ff549180f66dbb645f993e3937cfdbba58ff2d3854ebaf51331
Instruction Fuzzy Hash: E2F0AF757002019BD7209F26DC85B6BB7E8FF89701F05482AEA49C3250EB78A8088762

Uniqueness

Uniqueness Score: -1.00%

Function 007E40C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33stringCOMMON

Download Yara Rule

APIs

GetPropW.USER32(DirListData), ref: 007E40E2
SHGetPathFromIDListW.SHELL32(?,?), ref: 007E40F0
lstrcpyW.KERNEL32(?,?), ref: 007E4100

Strings

DirListData, xrefs: 007E40D5

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: FromListPathProplstrcpy
String ID: DirListData
API String ID: 1236027899-869039069
Opcode ID: 04c43c2cc0f545d7de90f47b6616ed3395bfeb8321a6b2c3c640e9fe8a306de6
Instruction ID: 5d8ef0fb1203a561f18cd8d961731e387f2d965e269719e7975b40c6cbf67ae1
Opcode Fuzzy Hash: 04c43c2cc0f545d7de90f47b6616ed3395bfeb8321a6b2c3c640e9fe8a306de6
Instruction Fuzzy Hash: 44F0B4B42003109FE724DF60DC4EABB7BE4FF58701F854529F829C22A2FA389944D752

Uniqueness

Uniqueness Score: -1.00%

Function 007D1567 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

#410.COMCTL32(?,007D1710,00000000,00000000), ref: 007D1585
SendMessageW.USER32(?,0000112C,00000000,00000064), ref: 007D1595
SendMessageW.USER32(?,00000127,00010001,00000000), ref: 007D15A8

Strings

ItemsView, xrefs: 007D15B0

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MessageSend$#410
String ID: ItemsView
API String ID: 147371132-272564461
Opcode ID: 069b78931dcf1cf1eec7a7f6099bc93aa6e508a66654f953729d374008378cc7
Instruction ID: db1e9567cb94ff6fbc97bc45892a11b05809fb798b238ae688db84ae45c2e1e9
Opcode Fuzzy Hash: 069b78931dcf1cf1eec7a7f6099bc93aa6e508a66654f953729d374008378cc7
Instruction Fuzzy Hash: 6FE04FB5380700BBF62117506C4FFBE2638BB9AF11F120015F705BE2E186ED2092D63A

Uniqueness

Uniqueness Score: -1.00%

Function 007FE436 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,007FE333,00000000,?,008E7AA8,?,?,?,007FE58A,00000004,InitializeCriticalSectionEx,00856CDC,InitializeCriticalSectionEx), ref: 007FE443
GetLastError.KERNEL32(?,007FE333,00000000,?,008E7AA8,?,?,?,007FE58A,00000004,InitializeCriticalSectionEx,00856CDC,InitializeCriticalSectionEx,00000000,?,007F7052), ref: 007FE44D
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 007FE475

Strings

api-ms-, xrefs: 007FE45A

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 44dc999a92544630a8bb8d14ab3bad052cd2f8cb52fb59407de5ad5f9d52fac0
Instruction ID: 78e62006aab48ec2fdd99806c4a37a72ac66545414e7aaa60dee05c1546d0992
Opcode Fuzzy Hash: 44dc999a92544630a8bb8d14ab3bad052cd2f8cb52fb59407de5ad5f9d52fac0
Instruction Fuzzy Hash: ADE01A30390288BBEB201BA0EC06B283A56BB12B41F148434FA8CE81E0E7A5E850C985

Uniqueness

Uniqueness Score: -1.00%

Function 007E4A10 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 007E4A35
CoTaskMemFree.OLE32(?), ref: 007E4A41
CoTaskMemFree.OLE32(?), ref: 007E4A53

Strings

, xrefs: 007E4A2D

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: FreeTask$MessageSend
String ID:
API String ID: 1000612462-3916222277
Opcode ID: 1d96d77e72d01585da2e0c5cbb867ad00a2caf2bf73ef9cd66a57cf765fd7d0e
Instruction ID: 370e63039fcd40209f70aa23b72675c2da6ae6dfc5f1fbd046464ed8f5b74274
Opcode Fuzzy Hash: 1d96d77e72d01585da2e0c5cbb867ad00a2caf2bf73ef9cd66a57cf765fd7d0e
Instruction Fuzzy Hash: 99F03979604200AFE304DF48ED88B6ABBF4FF8D710F004019F64997260D731E895CB52

Uniqueness

Uniqueness Score: -1.00%

Function 007E3230 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetPropW.USER32(00000000,DirListData), ref: 007E323A

Part of subcall function 007E3280: GetPropW.USER32(?,DirListData), ref: 007E328A
Part of subcall function 007E3280: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,007E3420,?,?), ref: 007E3298
Part of subcall function 007E3280: WaitForSingleObject.KERNEL32(?,00000000,?,?,?,?,?,?,?,007E3420,?,?), ref: 007E32A6
Part of subcall function 007E3280: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007E32D2
Part of subcall function 007E3280: TranslateMessage.USER32(?), ref: 007E32DD
Part of subcall function 007E3280: DispatchMessageW.USER32(?), ref: 007E32E4
Part of subcall function 007E3280: WaitForSingleObject.KERNEL32(?,00000000,?,?,?,?,?,?,?,007E3420,?,?), ref: 007E32EE
Part of subcall function 007E3280: ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,007E3420,?,?), ref: 007E3301
Part of subcall function 007E3280: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,007E3420,?,?), ref: 007E330D

ResetEvent.KERNEL32(?), ref: 007E3255
ResetEvent.KERNEL32(?), ref: 007E325D

Strings

DirListData, xrefs: 007E3234

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Event$MessageReset$ObjectPropSingleWait$DispatchPeekTranslate
String ID: DirListData
API String ID: 628585283-869039069
Opcode ID: ff4e6cb92d246e421d66ee369d93d5d0159fb7b268757607c58a97c0f335fa69
Instruction ID: 2d9ae4d1929a80550b5fd7b341b831fe3706bfaea8583415ee0d7478655ededc
Opcode Fuzzy Hash: ff4e6cb92d246e421d66ee369d93d5d0159fb7b268757607c58a97c0f335fa69
Instruction Fuzzy Hash: 05E08676A4112077DA142326BC0DF4A7E55FF85721F050166F4049726099A46D5189E4

Uniqueness

Uniqueness Score: -1.00%

Function 007E8380 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,00333333), ref: 007E838E
GetSysColor.USER32(0000000F), ref: 007E8398
SetBkColor.GDI32(?,00000000), ref: 007E83A0

Strings

333, xrefs: 007E8387

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Color
String ID: 333
API String ID: 2811717613-2463598333
Opcode ID: 67e3c47fcb3af2d38788b867fd3810d364d22c296632587a6ec5f9ee5b117cb6
Instruction ID: d110498d5022db5cdbbb799f579e4f18c7f37ebab7cc57d9af32d9dfd48814a8
Opcode Fuzzy Hash: 67e3c47fcb3af2d38788b867fd3810d364d22c296632587a6ec5f9ee5b117cb6
Instruction Fuzzy Hash: 63D0C939102861ABA661271CBD089EE261DFF4A632B0DC465B51591414DB980D4186B6

Uniqueness

Uniqueness Score: -1.00%

Function 0084342C Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(634AD31B,?,00000000,?), ref: 0084348F

Part of subcall function 00837DEA: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000001,0000FDE9,00000000,?,?,?,00831A39,?,00000000,?), ref: 00837E96

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 008436EA
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00843732
GetLastError.KERNEL32 ref: 008437D5

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: d27cf672407243d37a475683e2d829e7eca601b732a4e2a54b23bcf31fbe1b6e
Instruction ID: 880e6ba99fc9e067a6c0ee3570a1f848016e243cf7692d302627200b2c46b49a
Opcode Fuzzy Hash: d27cf672407243d37a475683e2d829e7eca601b732a4e2a54b23bcf31fbe1b6e
Instruction Fuzzy Hash: 52D149B5E0025CAFCF15CFA8D8809ADBBB5FF49314F18456AE866EB351D730AA41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00837F3C Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00837F44

Part of subcall function 00837DEA: WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,?,?,00000001,0000FDE9,00000000,?,?,?,00831A39,?,00000000,?), ref: 00837E96

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00837F7C
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00837F9C

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 7cd57112566f10ce4cb6abeb091c14b846f40a97e0042d2d8ad598d18d2193a4
Instruction ID: 4c153398c85b32a71ddb34a5b0b4dccfd7fbde456b0f2b95804b7791957f8868
Opcode Fuzzy Hash: 7cd57112566f10ce4cb6abeb091c14b846f40a97e0042d2d8ad598d18d2193a4
Instruction Fuzzy Hash: 5D11C4E550D51A7EA73627B96C9AC7F695CFEC5394F100525F401D1101FEA0DD0095F2

Uniqueness

Uniqueness Score: -1.00%

Function 007E8060 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003), ref: 007E80CE
VerSetConditionMask.KERNEL32(00000000), ref: 007E80D2
VerSetConditionMask.KERNEL32(00000000), ref: 007E80D6
VerifyVersionInfoW.KERNEL32(?,00000023,00000000), ref: 007E80F9

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: cad43cd8c6d2f81ec35ee4d08ff00a0ec2c4ba2c3c75a7d33ff8d9119d354172
Instruction ID: 26a0f304afffeccc2960b3eb1b0f26ca73f068b2582dd9a9ec13e5db771fdf72
Opcode Fuzzy Hash: cad43cd8c6d2f81ec35ee4d08ff00a0ec2c4ba2c3c75a7d33ff8d9119d354172
Instruction Fuzzy Hash: 5D1156B0658314AEE730DF25DC5AFAB7BE8EF98B10F00081EB588D72C0D6745604C766

Uniqueness

Uniqueness Score: -1.00%

Function 007E6B80 Relevance: 6.1, APIs: 4, Instructions: 59stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 007E6B99
LocalFree.KERNEL32(?), ref: 007E6BB9
LocalFree.KERNEL32(?), ref: 007E6BF9
StrDupW.SHLWAPI ref: 007E6C1D

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: FreeLocal$lstrcmpi
String ID:
API String ID: 4076108973-0
Opcode ID: b33a4df2d33eee47c4752559866e06c20b02bf1cac136bdbe460487f7d75ce64
Instruction ID: efefcb11759022d6ca4e26f32a7c5aef3ae6db9709bb4495c8a8b21f12f0af42
Opcode Fuzzy Hash: b33a4df2d33eee47c4752559866e06c20b02bf1cac136bdbe460487f7d75ce64
Instruction Fuzzy Hash: 2911E5B5702291ABCF345F6AACC4A0533E8F73FB5472A0421E540D7230D238F881CA22

Uniqueness

Uniqueness Score: -1.00%

Function 007D6FF0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,true,true,?,00000040,?,00000000), ref: 007D7053

Strings

Settings, xrefs: 007D7067
true, xrefs: 007D701D, 007D7046, 007D704C
false, xrefs: 007D7022

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Settings$false$true
API String ID: 626452242-540067373
Opcode ID: 41c57427a2f21e4297e3e3b9025f861d8b38c90c4d6d056a1597156401998344
Instruction ID: 7827b33d77b76c583e928def7073851a05df9093c94ddfa11820574c7be39493
Opcode Fuzzy Hash: 41c57427a2f21e4297e3e3b9025f861d8b38c90c4d6d056a1597156401998344
Instruction Fuzzy Hash: FD01DB717143406BE724CA688C55FB777FAFBC5711F04852ABA99C72C1DA74980CC762

Uniqueness

Uniqueness Score: -1.00%

Function 007E50E0 Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 007E50E9
LoadStringA.USER32(?,00000000,?), ref: 007E5104
LoadStringA.USER32(?,00000000,?), ref: 007E511B
LocalFree.KERNEL32(00000000), ref: 007E513C

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: LoadLocalString$AllocFree
String ID:
API String ID: 1922530790-0
Opcode ID: e8f77da192b029611e6ad7246367cf5e645014ca2e19c6fa4ee7d3f21e52c1d2
Instruction ID: 8f71bac317e1a8136d460a14d43201a531fd202d23ce383041771bc862995ddc
Opcode Fuzzy Hash: e8f77da192b029611e6ad7246367cf5e645014ca2e19c6fa4ee7d3f21e52c1d2
Instruction Fuzzy Hash: 5901B1762016896BD7208B26AC88F677BACFB8A799F150068F984D3210E635D801C631

Uniqueness

Uniqueness Score: -1.00%

Function 0084562E Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001,?), ref: 00845644
GetLastError.KERNEL32(?,?,?,?), ref: 00845651
SetFilePointerEx.KERNEL32(?,?,?,?,?), ref: 00845677
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,?,?), ref: 0084569D

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: 555a809a672bec10ab6eb18484c307cd0ed0f940df0b1f51a1aee6f1fc12e400
Instruction ID: a9a6e3b6a332cdba8631ea0a46658a38b525679c07622d56cda120eb513b9d86
Opcode Fuzzy Hash: 555a809a672bec10ab6eb18484c307cd0ed0f940df0b1f51a1aee6f1fc12e400
Instruction Fuzzy Hash: 091175B5802128BBCF109FA5DC499DE7F79FF11364F508144F920E62A2D771CA50DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 007E8120 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003,00000000), ref: 007E8186
VerSetConditionMask.KERNEL32(00000000), ref: 007E818A
VerSetConditionMask.KERNEL32(00000000), ref: 007E818E
VerifyVersionInfoW.KERNEL32(00000023), ref: 007E81B3

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: e4482a2947be2660c9a41618921fdafd077652d8cd3d7184b9fb1a65ddb82767
Instruction ID: a19417a8ba50824ad5df3dd10ca4c127dd770ca3874742a91c187873e66c61b3
Opcode Fuzzy Hash: e4482a2947be2660c9a41618921fdafd077652d8cd3d7184b9fb1a65ddb82767
Instruction Fuzzy Hash: DE1121B0654304AEE760DF24DC4AFAB7AE8EF84710F40481DB588D72C0D7B896088B96

Uniqueness

Uniqueness Score: -1.00%

Function 007E81E0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003,00000000), ref: 007E8246
VerSetConditionMask.KERNEL32(00000000), ref: 007E824A
VerSetConditionMask.KERNEL32(00000000), ref: 007E824E
VerifyVersionInfoW.KERNEL32(00000023), ref: 007E8273

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: 0808cbad8d24883ff4822d0b73cf007ab0923b5e79d2f16d74283047667cc808
Instruction ID: b9a2b752a97c21041c561be3bbef459e0ed4254e3baa3f33fc6bb876eb966385
Opcode Fuzzy Hash: 0808cbad8d24883ff4822d0b73cf007ab0923b5e79d2f16d74283047667cc808
Instruction Fuzzy Hash: FE1121B0644304AEE760DF24DC0AFAB7AE8EF84710F40481DB588D72C0D6B896188B96

Uniqueness

Uniqueness Score: -1.00%

Function 007E82A0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003,00000000), ref: 007E8306
VerSetConditionMask.KERNEL32(00000000), ref: 007E830A
VerSetConditionMask.KERNEL32(00000000), ref: 007E830E
VerifyVersionInfoW.KERNEL32(00000023), ref: 007E8333

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: 09d0f48105ca05f3d2fab70f420e4d4942b431b07c689da47c3d351a31598530
Instruction ID: 625fb532700644318d0f2e2648d2d2579da2d7782f65cbb075de29a591350ac8
Opcode Fuzzy Hash: 09d0f48105ca05f3d2fab70f420e4d4942b431b07c689da47c3d351a31598530
Instruction Fuzzy Hash: 6D1121B0644304AEE760DF24DC0AFAB7AE8EF84710F40481DB588D72C0D6B896088B96

Uniqueness

Uniqueness Score: -1.00%

Function 007E3E40 Relevance: 6.1, APIs: 4, Instructions: 52windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001032,00000000,00000000), ref: 007E3E5C
SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 007E3E6C
SendMessageW.USER32(?,?,?,0000104B), ref: 007E3E91
SHGetDataFromIDListW.SHELL32(?,?,00000001,?,00000250), ref: 007E3EAB

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: MessageSend$DataFromList
String ID:
API String ID: 101582348-0
Opcode ID: 21883b8ad550354284118e6729c95d7add5cf3b4651dc28c44ef5fd3fd313fc2
Instruction ID: 5ac31f672444d1f776bd5eb9d81b0be1f6914a25917d1262175ec81de8d23008
Opcode Fuzzy Hash: 21883b8ad550354284118e6729c95d7add5cf3b4651dc28c44ef5fd3fd313fc2
Instruction Fuzzy Hash: 5101B1712443407BF7009B188C42F9A7798BF89770F540619F664AA2E0C3E5ED058766

Uniqueness

Uniqueness Score: -1.00%

Function 007E0210 Relevance: 6.1, APIs: 4, Instructions: 51stringCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(008ED39C,008ED39C), ref: 007E0234

Part of subcall function 007E7A20: FindResourceW.KERNEL32(00000000,?,00000005,?,?), ref: 007E7A37
Part of subcall function 007E7A20: LoadResource.KERNEL32(00000000,00000000), ref: 007E7A4A
Part of subcall function 007E7A20: LockResource.KERNEL32(00000000), ref: 007E7A5B
Part of subcall function 007E7A20: SizeofResource.KERNEL32(00000000,00000000), ref: 007E7A6E
Part of subcall function 007E7A20: LocalAlloc.KERNEL32(00000040,00000040), ref: 007E7A84
Part of subcall function 007E7A20: FreeResource.KERNEL32(00000000), ref: 007E7AA0
Part of subcall function 007E7A20: lstrlenW.KERNEL32(?), ref: 007E7B1D

DialogBoxIndirectParamW.USER32(?,00000000,?,Function_0000FEA0,00000000), ref: 007E025C
LocalFree.KERNEL32(00000000,?,Function_0000FEA0,00000000), ref: 007E0269
lstrcmpiW.KERNEL32(008ED39C,?,?,Function_0000FEA0,00000000), ref: 007E027E

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Resource$FreeLocal$AllocDialogFindIndirectLoadLockParamSizeoflstrcmpilstrcpylstrlen
String ID:
API String ID: 2002630831-0
Opcode ID: 6e878b59eefece351e479f6ee464cb6dc6096dfe88f19fafb6a1060a92c8188b
Instruction ID: c48ed678ec7159f559d12dd76c1d4fefcafb80c85d5bd28d2de40b02559bf622
Opcode Fuzzy Hash: 6e878b59eefece351e479f6ee464cb6dc6096dfe88f19fafb6a1060a92c8188b
Instruction Fuzzy Hash: 9701F9752013859FD720AB65EC89BBB77DCF749710F400035FA15D3340E6F99C448662

Uniqueness

Uniqueness Score: -1.00%

Function 007E6E40 Relevance: 6.1, APIs: 4, Instructions: 51stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 007E6E6D
lstrcmpW.KERNEL32 ref: 007E6E75
LocalFree.KERNEL32(?), ref: 007E6E94
StrDupW.SHLWAPI ref: 007E6EC3

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: FreeLocallstrcmplstrcmpi
String ID:
API String ID: 2513707357-0
Opcode ID: bfd8de2e0e7b84510bd4c673527066182686623d6c41e0174e29dc8f53c898ac
Instruction ID: d430e05226e1dfd9d82cb516cca049639787692b5d86f9b42dded14b42e413df
Opcode Fuzzy Hash: bfd8de2e0e7b84510bd4c673527066182686623d6c41e0174e29dc8f53c898ac
Instruction Fuzzy Hash: FB110835701B53DBC7249F29D848797F764FF55345F058525E86993052D730B801C790

Uniqueness

Uniqueness Score: -1.00%

Function 007EC534 Relevance: 6.0, APIs: 4, Instructions: 44stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007E7A20: FindResourceW.KERNEL32(00000000,?,00000005,?,?), ref: 007E7A37
Part of subcall function 007E7A20: LoadResource.KERNEL32(00000000,00000000), ref: 007E7A4A
Part of subcall function 007E7A20: LockResource.KERNEL32(00000000), ref: 007E7A5B
Part of subcall function 007E7A20: SizeofResource.KERNEL32(00000000,00000000), ref: 007E7A6E
Part of subcall function 007E7A20: LocalAlloc.KERNEL32(00000040,00000040), ref: 007E7A84
Part of subcall function 007E7A20: FreeResource.KERNEL32(00000000), ref: 007E7AA0
Part of subcall function 007E7A20: lstrlenW.KERNEL32(?), ref: 007E7B1D

DialogBoxIndirectParamW.USER32(?,00000000,?,Function_00011DE0,?), ref: 007EC556
LocalFree.KERNEL32(00000000,?,Function_00011DE0,?), ref: 007EC563
lstrcpyW.KERNEL32(?,?), ref: 007EC582
CreateDirectoryW.KERNEL32(?,00000000,?,Function_00011DE0,?), ref: 007EC592

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Resource$FreeLocal$AllocCreateDialogDirectoryFindIndirectLoadLockParamSizeoflstrcpylstrlen
String ID:
API String ID: 3032008022-0
Opcode ID: 3c9d82d393168c9b073799b188dcfe6e1f55f186c76bc312c74660146e9338c9
Instruction ID: 0d32882e9eca415f22d35585c20ac184c9ca0d27129acd0cb1806b8c2629e42a
Opcode Fuzzy Hash: 3c9d82d393168c9b073799b188dcfe6e1f55f186c76bc312c74660146e9338c9
Instruction Fuzzy Hash: 4E01F97BA041949BE3209B61EC89FFF73ACBB89711F440525F649D2141EF799940C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 007E7E20 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000048,00000008,00000000), ref: 007E7E44
GetWindowRect.USER32(?,?), ref: 007E7E57

Part of subcall function 007E7C80: FindWindowExW.USER32(00000000,00000000,Shell_TrayWnd,00000000), ref: 007E7CA3
Part of subcall function 007E7C80: FindWindowExW.USER32(00000000,00000000,TrayNotifyWnd,00000000), ref: 007E7CB3
Part of subcall function 007E7C80: GetWindowRect.USER32(00000000,?), ref: 007E7CBB

DrawAnimatedRects.USER32(?,00000003,?,?,?,?), ref: 007E7E73
ShowWindow.USER32(?,00000000), ref: 007E7E7C

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Window$FindRect$AnimatedDrawInfoParametersRectsShowSystem
String ID:
API String ID: 56971534-0
Opcode ID: 9b9e02502cae3122b60f8c88467af10ec78fc3a0f445287b466008aa56607303
Instruction ID: b9303e8c391b663d02e9b5fa1896a254a5accd9113ae89d7ea03414de054a414
Opcode Fuzzy Hash: 9b9e02502cae3122b60f8c88467af10ec78fc3a0f445287b466008aa56607303
Instruction Fuzzy Hash: 41F06975105700AFE304DF10DC4ABAE7BACFF49701F404809F58996190DB78AA48CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 007ED2FC Relevance: 6.0, APIs: 4, Instructions: 29windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 007ED30C
GetFocus.USER32 ref: 007ED31C
GetDlgCtrlID.USER32(00000000), ref: 007ED323
SetFocus.USER32 ref: 007ED336

Part of subcall function 007E5C50: GetClientRect.USER32(?,?), ref: 007E5C67
Part of subcall function 007E5C50: SendMessageW.USER32(?,00000005,00000000,?), ref: 007E5C82

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: Focus$ClientCtrlMessageRectSendShowWindow
String ID:
API String ID: 297912541-0
Opcode ID: bff07785fec53f56a7d2fbcc8dd72f7e9c09b962dbcdf52281b23c44c60e9c2e
Instruction ID: a5ac88b6851f3a7cf3626b869ce93ee5a0f743351b2a90e32a9312eb3cb7cdf4
Opcode Fuzzy Hash: bff07785fec53f56a7d2fbcc8dd72f7e9c09b962dbcdf52281b23c44c60e9c2e
Instruction Fuzzy Hash: EEF08279309684CBD7046FB1AC5D27DB760FB5A305F95482AE106C5171DA3D8448C713

Uniqueness

Uniqueness Score: -1.00%

Function 007E67E0 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

SHGetSpecialFolderLocation.SHELL32(00000000,00000010,?), ref: 007E67F0
SHGetPathFromIDListW.SHELL32(?), ref: 007E67FF
CoTaskMemFree.OLE32(?), ref: 007E6809
GetWindowsDirectoryW.KERNEL32 ref: 007E6815

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: DirectoryFolderFreeFromListLocationPathSpecialTaskWindows
String ID:
API String ID: 2330934124-0
Opcode ID: 185d4b8db07ca424fdc8a3e232a62b61bff626f5add0a769cc448e54d679439d
Instruction ID: 386857a36add474789a69c32bed0c8f628f4bcf3e08a89a3a15e3855a983f73d
Opcode Fuzzy Hash: 185d4b8db07ca424fdc8a3e232a62b61bff626f5add0a769cc448e54d679439d
Instruction Fuzzy Hash: 00E01A7A202210BBD6251B55FC0CEDB7F68FBD67B3F10843AF54AC1161DB718811D661

Uniqueness

Uniqueness Score: -1.00%

Function 02AB27BF Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 02AB27D1
GetCurrentThreadId.KERNEL32 ref: 02AB27E0
GetCurrentProcessId.KERNEL32 ref: 02AB27E9
QueryPerformanceCounter.KERNEL32(?), ref: 02AB27F6

Memory Dump Source

Source File: 0000000A.00000002.22781985168.0000000002A40000.00000040.00001000.00020000.00000000.sdmp, Offset: 02A40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2a40000_HkObDPju6Z.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 8034145eba2c893d6e7baca235e11d8ffea090ba02b0f6dba33c4f1925a742cd
Instruction ID: 65d09d36f7598504308a51d0082900a871456ac7210dd91e9d9394c8c5d27214
Opcode Fuzzy Hash: 8034145eba2c893d6e7baca235e11d8ffea090ba02b0f6dba33c4f1925a742cd
Instruction Fuzzy Hash: EEF05F71C10209EBDF00DBB4D64DA9EBBF8FF18319F9148959412EB140EB34EB1A9B61

Uniqueness

Uniqueness Score: -1.00%

Function 007F2E16 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,007F2D9B,00000064), ref: 007F2E39
LeaveCriticalSection.KERNEL32(008E76F4,?,?,007F2D9B,00000064), ref: 007F2E43
WaitForSingleObjectEx.KERNEL32(?,00000000,?,007F2D9B,00000064), ref: 007F2E54
EnterCriticalSection.KERNEL32(008E76F4,?,007F2D9B,00000064), ref: 007F2E5B

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 70853166f26a132231cc1ff7f271560b7f6ab8cf6ce60bb7819cd3dd8ed9e4a5
Instruction ID: 35d7e382eaa082bbbd22e96ed75bb549f9ccb5d8a63994fb5d1ceb497f3cfba8
Opcode Fuzzy Hash: 70853166f26a132231cc1ff7f271560b7f6ab8cf6ce60bb7819cd3dd8ed9e4a5
Instruction Fuzzy Hash: 37E0D835509924F7CF121F95EC089DD3F18FB27B55B000010FA1996370CBA41801CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 007F3E59 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 007F3E6B
GetCurrentThreadId.KERNEL32 ref: 007F3E7A
GetCurrentProcessId.KERNEL32 ref: 007F3E83
QueryPerformanceCounter.KERNEL32(?), ref: 007F3E90

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0e64941fd862f88b4bb663325182ac9dd43eab95c03eea770d64b04ad1ba6608
Instruction ID: f42a3db4f91d6ae838e87eeee8f5af9958268658b2f38164ff442f8157ba93bd
Opcode Fuzzy Hash: 0e64941fd862f88b4bb663325182ac9dd43eab95c03eea770d64b04ad1ba6608
Instruction Fuzzy Hash: 5EF04D75C10219EFCB04DFB4D989A9EBBB8FF28205F514895A412E7150E6B4AB04DB51

Uniqueness

Uniqueness Score: -1.00%

Function 007E67A0 Relevance: 6.0, APIs: 4, Instructions: 24COMMON

Download Yara Rule

APIs

SHGetSpecialFolderLocation.SHELL32(00000000,00000005,?), ref: 007E67AD
SHGetPathFromIDListW.SHELL32(?), ref: 007E67BC
CoTaskMemFree.OLE32(?), ref: 007E67C6
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 007E67D5

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: DirectoryFolderFreeFromListLocationPathSpecialTaskWindows
String ID:
API String ID: 2330934124-0
Opcode ID: 2be43a015a1050a3018f6946d1c84b4c9237606aea1641353f0ad775024bbf67
Instruction ID: ba3d4d22759482aca216d947dbfebe99a799256e28fc41df72b575f53d38432e
Opcode Fuzzy Hash: 2be43a015a1050a3018f6946d1c84b4c9237606aea1641353f0ad775024bbf67
Instruction Fuzzy Hash: C9E08675202210BBE6115F50EC0DFDB7B58FF45B63F004019F506C10A0E7704C00DA51

Uniqueness

Uniqueness Score: -1.00%

Function 007F66C2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 007F66E7

Strings

MOC, xrefs: 007F66F9
RCC, xrefs: 007F6701

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: fa7b5de12a65764df0c84f813967c2f667bb8882fa2bacd204cefc3b854ec417
Instruction ID: 72bcf192688cc771dc03035a94cccaacb02a0f839ea85a3d5cf6ba574e7445c2
Opcode Fuzzy Hash: fa7b5de12a65764df0c84f813967c2f667bb8882fa2bacd204cefc3b854ec417
Instruction Fuzzy Hash: E141287190020DEFCF15EF98C985AAEBBB5FF48308F158199FA14A7321D3399950DB61

Uniqueness

Uniqueness Score: -1.00%

Function 007E6000 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35stringCOMMON

Download Yara Rule

APIs

PathFindExtensionW.SHLWAPI(?,.lnk,775DF670), ref: 007E6027
lstrcmpiW.KERNEL32(00000000), ref: 007E602E

Part of subcall function 007E6080: CoCreateInstance.OLE32(0085378C,00000000,00000001,0084FD7C,?,0000C356,?), ref: 007E60AF
Part of subcall function 007E6080: lstrcpyW.KERNEL32(?,?), ref: 007E60DB
Part of subcall function 007E6080: ExpandEnvironmentStringsW.KERNEL32(?,?,00000138), ref: 007E6152
Part of subcall function 007E6080: lstrcpynW.KERNEL32(?,?,?), ref: 007E616C

Strings

.lnk, xrefs: 007E6021

Memory Dump Source

Source File: 0000000A.00000002.22773130164.00000000007D1000.00000020.00000001.01000000.00000004.sdmp, Offset: 007D0000, based on PE: true

Associated: 0000000A.00000002.22773073947.00000000007D0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22774896316.000000000084E000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775307997.0000000000863000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22775447261.0000000000864000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008E7000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777246536.00000000008EB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000A.00000002.22777475582.00000000008EE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7d0000_HkObDPju6Z.jbxd

Similarity

API ID: CreateEnvironmentExpandExtensionFindInstancePathStringslstrcmpilstrcpylstrcpyn
String ID: .lnk
API String ID: 2874927818-24824748
Opcode ID: 7cef487fec6a56b6198469079d0961df1aa9105a648f68fa7b59d3fafabe749d
Instruction ID: bfd88253a0aa25ecf06edd9d4b67191e145f7eda376d0c3f39374b1c8eccdcfd
Opcode Fuzzy Hash: 7cef487fec6a56b6198469079d0961df1aa9105a648f68fa7b59d3fafabe749d
Instruction Fuzzy Hash: B2F0B471A017209BD734AF38D84EAEF73D4BF68710F844959E86986291FEBC458486C2

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report HkObDPju6Z.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WinREAgent\Scratch\instructions_read_me.txt

C:\$WinREAgent\instructions_read_me.txt

C:\Intel\instructions_read_me.txt

C:\PerfLogs\instructions_read_me.txt

C:\Program Files (x86)\AutoIt3\Include\AVIConstants.au3

C:\Program Files (x86)\AutoIt3\Include\BorderConstants.au3

C:\Program Files (x86)\AutoIt3\Include\ButtonConstants.au3

C:\Program Files (x86)\AutoIt3\Include\CUIAutomation2.au3

C:\Program Files (x86)\AutoIt3\Include\Clipboard.au3

C:\Program Files (x86)\AutoIt3\Include\Color.au3

C:\Program Files (x86)\AutoIt3\Include\ColorConstants.au3

C:\Program Files (x86)\AutoIt3\Include\ComboConstants.au3

C:\Program Files (x86)\AutoIt3\Include\Constants.au3

C:\Program Files (x86)\AutoIt3\Include\Crypt.au3

C:\Program Files (x86)\AutoIt3\Include\Date.au3

C:\Program Files (x86)\AutoIt3\Include\DateTimeConstants.au3

C:\Program Files (x86)\AutoIt3\Include\Debug.au3

C:\Program Files (x86)\AutoIt3\Include\DirConstants.au3

Windows Analysis Report
HkObDPju6Z.exe